Last tested: 14 May, 2018

config vulnerabilities

Configuration control for production node deployments

View on npm

config (latest)

Published 24 Apr, 2018

Known vulnerabilities0
Vulnerable paths0
Dependencies2

No known vulnerabilities in config

Security wise, config seems to be a safe package to use.
Over time, new vulnerabilities may be disclosed on config and other packages. To easily find, fix and prevent such vulnerabilties, protect your repos with Snyk!

Vulnerable versions of config

Fixed in 0.4.18

Code Execution due to Deserialization

medium severity

Detailed paths

  • Introduced through: config@0.4.17 > js-yaml@0.3.7
  • Introduced through: config@0.4.17 > js-yaml@0.3.7
  • Introduced through: config@0.4.17 > js-yaml@0.3.7

Overview

The JS-YAML module for Node.js contained a code execution vulnerability prior to version 2.0.5. The maintainers of JS-YAML have patched this vulnerability and, beginning in version 2.1.0, have provided a safeLoad method for parsing YAML. Developers that use this module should make sure they have upgraded and should strongly consider porting their code to use the new safeLoad method.

Source: Node Security Project

Details

The module allowed code execution due to a custom data-type that it defined and parsed called !!js/function. The way it would parse the data was to create a new Function object in JavaScript based on the input, which is equivalent to calling eval on the input:

function resolveJavascriptFunction(object /*, explicit*/) {
  /*jslint evil:true*/
  var func;

  try {
    func = new Function('return ' + object);
    return func();
  } catch (error) {
    return NIL;
  }
}

That meant the code snippet below, when run, would execute code instead of simply defining a function:

var yaml = require('js-yaml');

x = "test: !!js/function > \n  \
function f() { \n    \
console.log(1); \n  \
}();"

yaml.load(x);

Remediation

Developers using the JS-YAML module should make sure that they are working with an up-to-date version and should strongly consider porting their code to use safeLoad in place of load, especially when accepting YAML derived from user input.

References

Fixed in 0.4.17

Regular Expression Denial of Service (DoS)

high severity

Detailed paths

  • Introduced through: config@0.4.16 > vows@0.8.1 > glob@4.0.6 > minimatch@1.0.0
  • Introduced through: config@0.4.16 > vows@0.8.1 > glob@4.0.6 > minimatch@1.0.0
  • Introduced through: config@0.4.16 > vows@0.8.1 > glob@4.0.6 > minimatch@1.0.0

Overview

minimatch is a minimalistic matching library used for converting glob expressions into JavaScript RegExp objects. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Many Regular Expression implementations may reach edge cases that causes them to work very slowly (exponentially related to input size), allowing an attacker to exploit this and can cause the program to enter these extreme situations by using a specially crafted input and cause the service to excessively consume CPU, resulting in a Denial of Service.

An attacker can provide a long value to the minimatch function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).

You can read more about Regular Expression Denial of Service (ReDoS) on our blog.

Remediation

Upgrade minimatch to version 3.0.2 or greater.

References