CVE-2021-32770: 
JavaScript vulnerability analysis and mitigation

The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 contains a security vulnerability that exposes .htaccess HTTP Basic Authentication credentials by leaking them into the app.js bundle during build-time. The vulnerability was discovered and disclosed on July 15, 2021, and affects users who initialize basic authentication credentials in the gatsby-config.js file (NVD, GitHub Advisory).

The vulnerability occurs when users configure HTTP Basic Authentication credentials in the gatsby-config.js file using the auth.htaccess configuration. The plugin inadvertently exposes these sensitive credentials by including them in the compiled app.js bundle, making them accessible to anyone who can access the bundle file. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High severity) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low complexity, no privileges required, and high impact on confidentiality (GitHub Advisory).

The exposure of HTTP Basic Authentication credentials could allow unauthorized users to access protected resources using the leaked credentials. This could potentially lead to unauthorized access to sensitive content or systems protected by these credentials (GitHub Advisory).

The vulnerability is easily exploitable as it requires no special privileges or user interaction. Any attacker who can access the app.js bundle can extract the exposed credentials. Users who do not initialize basic authentication credentials in the gatsby-config.js are not affected by this vulnerability (GitHub Advisory).

The vulnerability has been patched in versions 4.0.8 and 5.9.2 of gatsby-source-wordpress. The fix filters all variables specified in the auth section. Users are advised to upgrade to the latest release, run gatsby clean followed by gatsby build. If immediate updating is not possible, the only known workaround is manually editing the app.js file post-build (GitHub Advisory).