Find, fix and prevent vulnerabilities in your code.

Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of this package are vulnerable to Directory Traversal in the locale() function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to moment.locale(). This requires the application to hand user-supplied non-string input directly to moment.locale(), plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.

Note: This is a bypass of the fix for the vulnerability described in CVE-2022-24785.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade moment to version 2.31.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext ws:// where a MitM can alter the handshake.

Remediation

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache() interceptor's shared-cache mode (type: 'shared'), which stores responses without excluding their Set-Cookie headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a Set-Cookie header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable Set-Cookie responses from a multi-user or untrusted upstream, and private caches are unaffected.

Workaround

This vulnerability can be avoided by running the cache interceptor in private mode (type: 'private'), so per-user Set-Cookie responses are not shared across callers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress() interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose Content-Encoding expands to gigabytes. This requires the application to use the interceptors.decompress() interceptor against untrusted or compromised upstream servers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like response.body.text() never complete. This requires the application to retry requests through the RetryHandler, and bodyTimeout does not fire because the orphaned body is never active.

Workaround

This vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since bodyTimeout alone does not release the orphaned body.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort() on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default unhandledRejection handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the WebSocketStream API while actively writing through a writer, and the server to be attacker-controlled or compromised.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners() on the zlib InflateRaw object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting Z_DATA_ERROR has no listener. This requires the application to use undici's WebSocket client or Node's bundled globalThis.WebSocket against an attacker-controlled or compromised WebSocket server.

Remediation

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

References

• GitHub Advisory
• GitHub Commit