Conversation
|
📗 Scan Summary
🚥 Policy Violations🚨 Security Violations
🔖 Details[ CVE-2019-10744 ] lodash 4.17.0 (shani_ejs_build)Violation Details
Insufficient input validation in lodash defaultsDeep() leads to prototype pollution. 🔬 JFrog Research DetailsDescription: The function Example of code vulnerable to this issue - const lodash = require('lodash');
const evilsrc = {constructor: {prototype: {evilkey: "evilvalue"}}};
lodash.defaultsDeep({}, evilsrc)Remediation: Development mitigationsAdd the [ CVE-2022-29078 ] ejs 3.1.6 (shani_ejs_build)Violation Details
Insufficient input validation in EJS enables attackers to perform template injection when attacker can control the rendering options. 🔬 JFrog Research DetailsDescription: When rendering views using EJS, it is possible to perform template injection on the Once template injection is achieved, the attacker can immediately perform remote code execution since the template engine (EJS) allows executing arbitrary JavaScript code. Example of a vulnerable Node.js application - const express = require('express');
const bodyParser = require('body-parser');
const lodash = require('lodash');
const ejs = require('ejs');
const app = express();
app
.use(bodyParser.urlencoded({extended: true}))
.use(bodyParser.json());
app.set('views', './');
app.set('view engine', 'ejs');
app.get("/", (req, res) => {
res.render('index');
});
app.post("/", (req, res) => {
let data = {};
let input = JSON.parse(req.body.content);
lodash.defaultsDeep(data, input);
res.json({message: "OK"});
});
let server = app.listen(8086, '0.0.0.0', function() {
console.log('Listening on port %d', server.address().port);
});Exploiting the above example for RCE - Due to the prototype pollution in the Remediation: Development mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect [ CVE-2021-23555 ] vm2 3.9.4 (shani_ejs_build)Violation Details
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine. [ CVE-2025-58754 ] axios 0.21.4 (shani_ejs_build)Violation Details
Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.11.0 runs on Node.js and is given a URL with the [ CVE-2018-16487 ] lodash 4.17.0 (shani_ejs_build)Violation Details
Insufficient input validation in the Lodash library leads to prototype pollution. 🔬 JFrog Research DetailsDescription: The The library implementation has a bug in the A related CVE (CVE-2018-3721) covers the same issue prior to Lodash version 4.17.5, but the fix for that was incomplete. Remediation: Development mitigationsAdd the [ CVE-2019-1010266 ] lodash 4.17.0 (shani_ejs_build)Violation Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11. [ CVE-2018-3721 ] lodash 4.17.0 (shani_ejs_build)Violation Details
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects. [ CVE-2024-43800 ] serve-static 1.15.0 (shani_ejs_build)Violation Details
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. [ CVE-2024-43799 ] send 0.18.0 (shani_ejs_build)Violation Details
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0. [ CVE-2024-43796 ] express 4.18.2 (shani_ejs_build)Violation Details
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0. [ CVE-2024-29041 ] express 4.18.2 (shani_ejs_build)Violation Details
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using [ CVE-2023-45857 ] axios 0.21.4 (shani_ejs_build)Violation Details
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. [ CVE-2023-32313 ] vm2 3.9.4 (shani_ejs_build)Violation Details
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node [ CVE-2023-36665 ] protobufjs 6.11.2 (shani_ejs_build)Violation Details
Insufficient input validation in protobuf.js leads to multiple prototype pollution issues. 🔬 JFrog Research DetailsDescription: Multiple prototype pollution vulnerabilities were detected in the
protobuf.util.setProperty({}, "constructor.prototype.verified", true);
let obj = new protobuf.ReflectionObject("Test");
obj.setParsedOption("unimportant!", attackerFunc, "constructor.prototype.testFn");
protobuf.parse('option(a).constructor.prototype.verified = true;');
protobuf.loadSync("poc.proto");an example malicious While most prototype pollution attacks lead to denial of service, it has been reported that code execution is possible when unsanitized user input is provided to the functions Remediation: Development mitigationsAdd the [ CVE-2023-32314 ] vm2 3.9.4 (shani_ejs_build)Violation Details
A prototype lookup vulnerability in vm2 leads to arbitrary code execution when running untrusted input in the vm2 sandbox. [ CVE-2023-30547 ] vm2 3.9.4 (shani_ejs_build)Violation Details
A prototype lookup vulnerability in vm2 leads to arbitrary code execution when running untrusted input in the vm2 sandbox. 🔬 JFrog Research DetailsDescription: To prevent the leaking of host context information into the virtual machine, the code given to the However, this may be proxied through a Example of running untrusted code in the sandbox - [ CVE-2023-29199 ] vm2 3.9.4 (shani_ejs_build)Violation Details
Improper exception sanitization logic in vm2 leads to arbitrary code execution when running untrusted input in the vm2 sandbox. 🔬 JFrog Research DetailsDescription: To prevent the leaking of host context information into the virtual machine, the code given to the Example of running untrusted code in the sandbox - Example of malicious code that triggers the issue when processed by the Remediation: Development mitigationsPrevent user code to contain const { VM } = require('vm2');
const vm = new VM();
const code = userInputCode();
...
const modifiedCode = code.replace(/$tmpname/g, 'myCustomName');
vm.run(modifiedCode);[ CVE-2023-29017 ] vm2 3.9.4 (shani_ejs_build)Violation Details
A prototype lookup vulnerability in vm2 leads to arbitrary code execution when running untrusted input in the vm2 sandbox. 🔬 JFrog Research DetailsDescription: Specifically, the Example of running untrusted code in the sandbox - [ CVE-2022-25893 ] vm2 3.9.4 (shani_ejs_build)Violation Details
A prototype lookup vulnerability in vm2 leads to arbitrary code execution when running untrusted input in the vm2 sandbox. 🔬 JFrog Research DetailsDescription: The vm2 package provides a secure virtual environment for running untrusted code, which cannot be escaped to the host machine. Specifically, the Vulnerable code snippet - Remediation: Development mitigationsPrefix the untrusted code with new VM().run( // Untrusted code here... [ CVE-2022-36067 ] vm2 3.9.4 (shani_ejs_build)Violation Details
Sandbox escape in vm2 leads to code execution when executing untrusted code. 🔬 JFrog Research DetailsDescription: It was discovered that due to insecure error handling, an attacker could create code that runs inside the sandbox but eventually creates an object outside of the sandbox that would be subsequently executed. This allows the attacker to perform malicious operations such as execution arbitrary shell commands using the The vulnerability has an extensive technical writeup, making the creation of a PoC trivial. Example of running untrusted code in the sandbox - const {VM} = require('vm2');
new VM().run(attacker_javascript_code_as_string);Remediation: Development mitigationsDefine the global const {VM} = require('vm2');
const vm2 = new VM();
// Define the Error object
vm2.sandbox.Error = Error;
// Now we can execute untrusted code
new VM().run(attacker_javascript_code_as_string);[ CVE-2025-27152 ] axios 0.21.4 (shani_ejs_build)Violation Details
A design problem in Axios may lead to SSRF when using path-relative URLs. 🔬 JFrog Research DetailsDescription: A relative URL is a link to a URL which uses a given base URL and by doing so ensures the user make requests only within the base URL. For example if a base URL Axios offers the developer the ability to allow/not allow making requests based on absolute URLs using the A bug in the [ CVE-2024-52798 ] path-to-regexp 0.1.7 (shani_ejs_build)Violation Details
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296. [ CVE-2024-45590 ] body-parser 1.20.1 (shani_ejs_build)Violation Details
Insufficient input validation in body-parser may lead to denial of service when parsing a crafted request. 🔬 JFrog Research DetailsRemediation: Development mitigationsThe vulnerability can be mitigated by specifying [ CVE-2024-45296 ] path-to-regexp 0.1.7 (shani_ejs_build)Violation Details
ReDoS in path-to-regexp may lead to denial of service when parsing crafted input. 🔬 JFrog Research DetailsRemediation: Development mitigationsThis vulnerability can be mitigated by manually defining the parameter's regular expression when two or more parameters exist in a single segment. For example, [ CVE-2022-25878 ] protobufjs 6.11.2 (shani_ejs_build)Violation Details
Insufficient input validation in protobuf.js leads to multiple prototype pollution issues. 🔬 JFrog Research DetailsDescription:
protobuf.util.setProperty({}, "__proto__.someprop", "somevalue");
let obj = new protobuf.ReflectionObject("Test")
obj.setParsedOption({}, "somevalue", "__proto__.someprop");
let p = `option (foo).__proto__.someprop= "somevalue";`
protobuf.parse(p)
protobuf.load("/path/to/untrusted.proto", function(err, root) { ... });Remediation: Development mitigationsAdd the [ CVE-2021-23337 ] lodash 4.17.0 (shani_ejs_build)Violation Details
Improper sanitization in the lodash template function leads to JavaScript code injection through the options argument. 🔬 JFrog Research DetailsDescription: lodash.template('', { variable: '){console.log(process.env)}; with(obj' })()[ CVE-2020-8203 ] lodash 4.17.0 (shani_ejs_build)Violation Details
Prototype pollution in lodash object merging and zipping functions leads to code injection. 🔬 JFrog Research DetailsDescription: JavaScript frontend and Node.js-based backend applications that merge or zip objects using the lodash functions Remediation: Deployment mitigationsAs general guidelines against prototype pollution, first consider not merging objects originating from user input or using a Map structure instead of an object. If merging objects is needed, look into creating objects without a prototype with [ CVE-2024-33883 ] ejs 3.1.6 (shani_ejs_build)Violation Details
Insufficient input validation in EJS may lead to prototype pollution. 🔬 JFrog Research DetailsDescription: A prototype pollution gadget within the EJS template engine could potentially be leveraged by attackers to achieve remote code execution or DoS via prototype pollution. When checking for the presence of a property within an object variable, the lookup scope isn't explicitly defined. In JavaScript, the absence of a defined lookup scope prompts a search up to the root prototype ( If the application server is using the EJS as the backend template engine, and there is another prototype pollution vulnerability in the application, then the attacker could leverage the found gadgets in the EJS template engine to escalate the prototype pollution to remote code execution or DoS. The following code will execute a command on the server by polluting [ CVE-2020-28500 ] lodash 4.17.0 (shani_ejs_build)Violation Details
ReDoS in lodash could lead to a denial of service when handling untrusted strings. 🔬 JFrog Research DetailsDescription: On a modern Core i7-based system, calling the vulnerable functions with a 50kB string could take between 2 to 3 seconds to execute and 4.5 minutes for a longer 500kB string. The fix improved the regular expression performance so it took only a few milliseconds on the same Core i7-based system. This vulnerability is easily exploitable as all is required is to build a string that triggers it as can be seen in this PoC reproducing code - var untrusted_user_input_50k = "a" + ' '.repeat(50000) + "z"; // assume this is provided over the network
lo.trimEnd(untrusted_user_input_50k); // should take a few seconds to run
var untrusted_user_input_500k = "a" + ' '.repeat(500000) + "z"; // assume this is provided over the network
lo.trimEnd(untrusted_user_input_500k); // should take a few minutes to runRemediation: Deployment mitigationsTrim untrusted strings based on size before providing it to the vulnerable functions by using the |
at 📦🔍 Contextual Analysis CVE
DescriptionThe scanner checks whether the vulnerable function `defaultsDeep` is called with external input to its 2nd (`sources`) argument, and the `Object.freeze()` remediation is not present.CVE detailsVersions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.RemediationDevelopment mitigationsAdd the |
at 📦🔍 Contextual Analysis CVE
DescriptionThe scanner checks for two vulnerable flows:
The scanner also checks whether the CVE detailsThe ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).RemediationDevelopment mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect |
at 📦🔍 Contextual Analysis CVE
DescriptionThe scanner checks for two vulnerable flows:
The scanner also checks whether the CVE detailsThe ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).RemediationDevelopment mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect |
at 📦🔍 Contextual Analysis CVE
DescriptionThe scanner checks whether any of the following vulnerable functions are called:
The scanner also checks whether the CVE detailsA prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.RemediationDevelopment mitigationsAdd the |
at 🎯 Static Application Security Testing (SAST) Violation
Full descriptionViolation Details
OverviewSensitive Cookie Without 'HttpOnly' Flag in JavaScript refers to the Vulnerable Examplevar express = require("express");
var session = require("express-session");
var app = express();
app.use(
session({
cookie: {
domain: "domain.org",
secure: true,
httpOnly: false, // Vulnerable
name: "sensitive_cookie",
maxAge: 12 * 60 * 60 * 1000,
path: "/",
},
})
);In this example, the 'HttpOnly' flag is not set, allowing the sensitive Remediationvar express = require("express");
var session = require("express-session");
var app = express();
app.use(
session({
cookie: {
domain: "domain.org",
secure: true,
- httpOnly: false, // Vulnerable
+ httpOnly: true, // Corrected
name: "sensitive_cookie",
maxAge: 12 * 60 * 60 * 1000,
path: "/",
},
})
);By setting 'HttpOnly' to true, the sensitive cookie becomes inaccessible Explanation: In the vulnerable example, the 'HttpOnly' flag is set to false, allowing |
at 🎯 Static Application Security Testing (SAST) Violation
Full descriptionViolation Details
OverviewTemplate Object Injection (TOI) is a vulnerability that can occur in Query operationIn this query we look for user inputs that flow directly to a Vulnerable examplevar app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
res.render('template', bodyParameter);
});In this example, a user-provided data is injected directly into the Remediation+ const sanitizeHtml = require('sanitize-html');
var app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
- res.render('template', bodyParameter);
+ res.render('template', sanitizeHtml(bodyParameter));
});
Using `sanitize-html`, the user-provided data is sanitized, before
rendering to the response. |
1 participant
No description provided.