CVE-2021-38384
📋 TL;DR
Serverless Offline 8.0.0 incorrectly returns a 403 HTTP status code for routes with trailing slashes, while AWS Lambda returns 200. This discrepancy can lead developers to implement overly permissive access controls in production, potentially granting unauthorized access. Only affects developers using Serverless Offline 8.0.0 for local AWS Lambda development.
💻 Affected Systems
- Serverless Offline
📦 What is this software?
Serverless Offline by Serverless Offline Project
⚠️ Risk & Real-World Impact
Worst Case
Production AWS Lambda functions allow unauthorized access to protected resources due to developers incorrectly assuming trailing slash routes return 403 errors.
Likely Case
Developers waste time debugging inconsistent behavior between local and production environments, potentially deploying insecure configurations.
If Mitigated
Minimal impact if developers properly test in AWS environment before deployment and don't rely solely on local testing behavior.
🎯 Exploit Status
This is a development tool bug, not a production vulnerability. Exploitation requires developer misunderstanding of the discrepancy.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.1
Vendor Advisory: https://github.com/dherault/serverless-offline/issues/1259
Restart Required: Yes
Instructions:
1. Update package.json to use serverless-offline version 8.0.1 or later. 2. Run 'npm update serverless-offline' or 'yarn upgrade serverless-offline'. 3. Restart your development server.
🔧 Temporary Workarounds
Downgrade to 7.x
allRevert to previous stable version that doesn't have this behavior discrepancy
npm install serverless-offline@7
Manual route testing
allManually test all routes with and without trailing slashes in AWS environment before deployment
🧯 If You Can't Patch
- Always test access control logic directly in AWS Lambda environment, not just locally with Serverless Offline
- Implement comprehensive integration tests that run against actual AWS endpoints before deployment
🔍 How to Verify
Check if Vulnerable:
Check if serverless-offline version is exactly 8.0.0 in package.json or via 'npm list serverless-offline'Check Version:
npm list serverless-offline | grep serverless-offlineVerify Fix Applied:
After updating, test a route with trailing slash - it should return 200 status code matching AWS behavior📡 Detection & Monitoring
Log Indicators:
- Development logs showing 403 errors for trailing slash routes that work in production
Network Indicators:
- HTTP 403 responses from local development server for valid AWS Lambda routes
SIEM Query:
Not applicable - this is a development tool issue