Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bulk vulnerability fix - Lockfile fix #7

Closed
wants to merge 1 commit into from
Closed

Bulk vulnerability fix - Lockfile fix #7

wants to merge 1 commit into from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Oct 22, 2021

Bulk vulnerability fix - Lockfile fix

This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.

Fixed vulnerabilities:

CVE–2021–23343
CVE–2021–23364
CVE–2021–23362
CVE–2020–7597
  • Description

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

    GitHub

    codecov NPM module allows remote attackers to execute arbitrary commands

    codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

    NVD

    codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

  • CVSS details - 8.8

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity Low
    Privileges Required Low
    User interaction None
    Scope Unchanged
    Confidentiality High
    Integrity High
    Availability High
  • References

        NVD - CVE-2020-7597
        codecov NPM module allows remote attackers to execute arbitrary commands · CVE-2020-7597 · GitHub Advisory Database · GitHub
        [CE-1330] Escaping args (#167) · codecov/codecov-node@02cf13d · GitHub

CVE–2020–15123
CVE–2019–20149
debricked–124
CVE–2019–10747
CVE–2021–32804
  • Description

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    NVD

    The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

    GitHub

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    Impact

    Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

    node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc.

    This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite.

    Patches

    3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

    NOTE: an adjacent issue CVE-2021-32803 affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your node-tar use case.

    Workarounds

    Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths.

    const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})

    Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.

  • CVSS details - 8.1

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity Low
    Privileges Required None
    User interaction Required
    Scope Unchanged
    Confidentiality None
    Integrity High
    Availability High
  • References

        NVD - CVE-2021-32804
        Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization · CVE-2021-32804 · GitHub Advisory Database · GitHub
        Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization · Advisory · npm/node-tar · GitHub
        tar - npm
        fix: strip absolute paths more comprehensively · npm/node-tar@1f036ca · GitHub
        Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization · CVE-2021-32804 · GitHub Advisory Database · GitHub
        Oracle Critical Patch Update Advisory - October 2021

CVE–2021–32803
  • Description

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    NVD

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

    GitHub

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    Impact

    Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

    node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

    This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur.

    By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

    This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

    Patches

    3.2.3 || 4.4.15 || 5.0.7 || 6.1.2

    Workarounds

    Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

    const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

    Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.

  • CVSS details - 8.1

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity Low
    Privileges Required None
    User interaction Required
    Scope Unchanged
    Confidentiality None
    Integrity High
    Availability High
  • References

        THIRD PARTY
        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning · CVE-2021-32803 · GitHub Advisory Database · GitHub
        Remove paths from dirCache when no longer dirs · npm/node-tar@9dbdeb6 · GitHub
        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning · Advisory · npm/node-tar · GitHub
        tar - npm
        Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization · CVE-2021-32804 · GitHub Advisory Database · GitHub
        Oracle Critical Patch Update Advisory - October 2021

CVE–2021–37713
  • Description

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    NVD

    The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

    GitHub

    Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

    Impact

    Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

    node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory.

    This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory.

    Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path.

    This only affects users of node-tar on Windows systems.

    Patches

    4.4.18 || 5.0.10 || 6.1.9

    Workarounds

    There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does.

    Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

    Fix

    The fixed versions strip path roots from all paths prior to being resolved against the extraction target folder, even if such paths are not "absolute".

    Additionally, a path starting with a drive letter and then two dots, like c:../, would bypass the check for .. path portions. This is checked properly in the patched versions.

    Finally, a defense in depth check is added, such that if the entry.absolute is outside of the extraction taret, and we are not in preservePaths:true mode, a warning is raised on that entry, and it is skipped. Currently, it is believed that this check is redundant, but it did catch some oversights in development.

  • CVSS details - 8.6

     

    CVSS3 metrics
    Attack Vector Local
    Attack Complexity Low
    Privileges Required None
    User interaction Required
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High
  • References

        Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization · CVE-2021-37713 · GitHub Advisory Database · GitHub
        NVD - CVE-2021-37713
        tar - npm
        Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization · Advisory · npm/node-tar · GitHub
        Oracle Critical Patch Update Advisory - October 2021

CVE–2021–37712
  • Description

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    NVD

    The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

    GitHub

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    Impact

    Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

    node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

    This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include directories with two forms of the path that resolve to the same file system entity, followed by a symbolic link with a name in the first form, lastly followed by a file using the second form. It led to bypassing node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available below.

    Patches

    6.1.9 || 5.0.10 || 4.4.18

    Workarounds

    Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

    const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

    Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

    Fix

    The problem is addressed in the following ways, when comparing paths in the directory cache and path reservation systems:

    1. The String.normalize('NFKD') method is used to first normalize all unicode to its maximally compatible and multi-code-point form.
    2. All slashes are normalized to / on Windows systems (on posix systems, \ is a valid filename character, and thus left intact).
    3. When a symbolic link is encountered on Windows systems, the entire directory cache is cleared. Collisions related to use of 8.3 short names to replace directories with other (non-symlink) types of entries may make archives fail to extract properly, but will not result in arbitrary file writes.
  • CVSS details - 8.6

     

    CVSS3 metrics
    Attack Vector Local
    Attack Complexity Low
    Privileges Required None
    User interaction Required
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High
  • References

        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links · CVE-2021-37712 · GitHub Advisory Database · GitHub
        NVD - CVE-2021-37712
        tar - npm
        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links · Advisory · npm/node-tar · GitHub
        Oracle Critical Patch Update Advisory - October 2021

CVE–2021–37701
  • Description

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    NVD

    The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

    GitHub

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    Impact

    Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

    node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

    This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems.

    By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

    Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.

    These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7.

    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available below.

    Patches

    4.4.16 || 5.0.8 || 6.1.7

    Workarounds

    Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

    const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

    Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

    Fix

    The problem is addressed in the following ways:

    1. All paths are normalized to use / as a path separator, replacing \ with / on Windows systems, and leaving \ intact in the path on posix systems. This is performed in depth, at every level of the program where paths are consumed.
    2. Directory cache pruning is performed case-insensitively. This may result in undue cache misses on case-sensitive file systems, but the performance impact is negligible.

    Caveat

    Note that this means that the entry objects exposed in various parts of tar's API will now always use / as a path separator, even on Windows systems. This is not expected to cause problems, as / is a valid path separator on Windows systems, but may result in issues if entry.path is compared against a path string coming from some other API such as fs.realpath() or path.resolve().

    Users are encouraged to always normalize paths using a well-tested method such as path.resolve() before comparing paths to one another.

  • CVSS details - 8.6

     

    CVSS3 metrics
    Attack Vector Local
    Attack Complexity Low
    Privileges Required None
    User interaction Required
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High
  • References

        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links · CVE-2021-37701 · GitHub Advisory Database · GitHub
        NVD - CVE-2021-37701
        tar - npm
        Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links · Advisory · npm/node-tar · GitHub
        Oracle Critical Patch Update Advisory - October 2021

CVE–2021–23413
CVE–2021–32640
CVE–2019–16769
  • Description

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    GitHub

    Cross-Site Scripting in serialize-javascript

    Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

    Recommendation

    Upgrade to version 2.1.1 or later.

    NVD

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

  • CVSS details - 5.4

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity Low
    Privileges Required Low
    User interaction Required
    Scope Changed
    Confidentiality Low
    Integrity Low
    Availability None
  • References

        Cross-Site Scripting in serialize-javascript · CVE-2019-16769 · GitHub Advisory Database · GitHub
        NVD - CVE-2019-16769
        regular expressions Cross-Site Scripting (XSS) vulnerability · Advisory · yahoo/serialize-javascript · GitHub

CVE–2020–7660
  • Description

    Deserialization of Untrusted Data

    The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

    GitHub

    Insecure serialization leading to RCE in serialize-javascript

    serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

    An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.

    The following proof-of-concept calls console.log() when the running eval():
    eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');

    NVD

    serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

  • CVSS details - 8.1

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity High
    Privileges Required None
    User interaction None
    Scope Unchanged
    Confidentiality High
    Integrity High
    Availability High
  • References

        Insecure serialization leading to RCE in serialize-javascript · CVE-2020-7660 · GitHub Advisory Database · GitHub
        NVD - CVE-2020-7660
        Don't replace regex / function placeholders within string literals (#79) · yahoo/serialize-javascript@f21a6fb · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked

 

@debricked debricked bot closed this Feb 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants