Find, fix and prevent vulnerabilities in your code.

Overview

elliptic is a fast elliptic-curve cryptography implementation in plain javascript.

Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation due to the incorrect computation of the byte-length of k value with leading zeros resulting in its truncation. An attacker can obtain the secret key by analyzing both a faulty signature generated by a vulnerable implementation and a correct signature for the same inputs.

Note:

There is a distinct but related issue CVE-2024-48948.

Remediation

There is no fixed version for elliptic.

References

• GitHub Issue
• Herodevs Security Report

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release

Overview

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to CSV Injection through the CSV.write() process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write(), writeBuffer(), or writeFile(). When a victim opens the exported CSV in Excel or LibreOffice Calc, the injected value is treated as a live formula, enabling command execution tricks, external data fetches, or exfiltration of other cells in the spreadsheet.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Sanitize values yourself before calling workbook.csv.write(): prefix any string beginning with =, +, -, @, tab, or CR with a single quote ('). This prevents spreadsheet applications from interpreting attacker-controlled cell data as live formulas when you open the CSV.
• Avoid opening CSV exports of user-influenced data directly in a spreadsheet application. This prevents Excel or LibreOffice Calc from triggering formula execution on untrusted exports.

Remediation

Upgrade exceljs to version 5.0.0 or higher.

References

• GitHub Commit
• Maintainer's Advisory
• Vulnerable Code

Overview

unzipper is a library for the Uzip cross-platform streaming AP.I

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that the resolved path begins with the destination string (extractPath.indexOf(opts.path) != 0) without enforcing a directory-separator boundary. An attacker can write files outside the intended extraction directory, enabling file overwrite or code execution, by supplying a ZIP archive whose entry resolves to a sibling path such as /tmp/dest-evil/escaped.txt that shares the destination's string prefix, which a victim then extracts. Exploitation requires the victim to extract an untrusted archive with unzipper, and it works through sibling-prefix paths since standard ../../ traversal remains blocked.

Note: This is a bypass of the fix for the vulnerability described in CVE-2018-1002203.

Details

It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

+2018-04-15 22:04:29 ..... 19 19 good.txt

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for unzipper.

References

• GitHub Advisory
• GitHub Issue

MPL-2.0 license