CVE-2022-0355
📋 TL;DR
CVE-2022-0355 is an information disclosure vulnerability in the NPM simple-get package where sensitive data like authorization headers and cookies are improperly removed before being stored in debug logs. This affects any application using simple-get versions prior to 4.0.1 that has debug logging enabled, potentially exposing authentication credentials and session tokens.
💻 Affected Systems
- simple-get NPM package
📦 What is this software?
Simple Get by Simple Get Project
Simple Get by Simple Get Project
Simple Get by Simple Get Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to authentication tokens, session cookies, or API keys, leading to account takeover, data breaches, or lateral movement within systems.
Likely Case
Sensitive credentials exposed in debug logs that may be accessible to unauthorized users or logged to insecure locations.
If Mitigated
Limited exposure if debug logging is disabled or logs are properly secured with restricted access.
🎯 Exploit Status
Exploitation requires access to debug logs where sensitive information is stored. No authentication bypass is needed once log access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.1
Vendor Advisory: https://github.com/advisories/GHSA-wpg7-2c88-r8xv
Restart Required: Yes
Instructions:
1. Update package.json to specify simple-get version 4.0.1 or higher. 2. Run 'npm update simple-get' or 'yarn upgrade simple-get'. 3. Restart the application to load the patched version.
🔧 Temporary Workarounds
Disable debug logging
allDisable debug logging in simple-get configuration to prevent sensitive data from being logged.
Set DEBUG environment variable to exclude simple-get: DEBUG=*,-simple-get*
Secure log storage
allImplement strict access controls and encryption for log files containing debug information.
🧯 If You Can't Patch
- Disable debug logging entirely in production environments
- Implement log filtering to remove sensitive headers before storage
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list simple-get' to see if version is below 4.0.1Check Version:
npm list simple-get | grep simple-getVerify Fix Applied:
Confirm simple-get version is 4.0.1 or higher with 'npm list simple-get'📡 Detection & Monitoring
Log Indicators:
- Authorization headers, cookies, or other sensitive data appearing in debug logs from simple-get requests
Network Indicators:
- Unusual access patterns to log files or debug endpoints
SIEM Query:
source="application.log" AND "simple-get" AND ("authorization:" OR "cookie:")🔗 References
- https://github.com/advisories/GHSA-wpg7-2c88-r8xv
- https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f
- https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31
- https://github.com/advisories/GHSA-wpg7-2c88-r8xv
- https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f
- https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31
