Vulnerabilities	5 via 22 paths
Dependencies	425
Source	GitHub
Commit	6a2936a6

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications

Severity

Critical
2
High
2
Medium
1
Low

Status

Open
5
Patched
0
Ignored
0

critical severity

Remote Code Execution (RCE)

Vulnerable module: vm2
Introduced through: @salesforce/source-deploy-retrieve@7.15.1

Detailed paths

Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient checks which allow an attacker to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Remediation

There is no fixed version for vm2.

References

GitHub Issue

Remote Code Execution (RCE) vulnerability report

critical severity

Remote Code Execution (RCE)

Vulnerable module: vm2
Introduced through: @salesforce/source-deploy-retrieve@7.15.1

Detailed paths

Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Remediation

There is no fixed version for vm2.

References

Remote Code Execution (RCE) vulnerability report

high severity

new

Uncontrolled resource consumption

Vulnerable module: braces
Introduced through: @oclif/core@1.26.2 and @salesforce/command@5.3.9

Detailed paths

Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @oclif/core@1.26.2 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5 › braces@3.0.2
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @oclif/core@1.26.2 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5 › braces@3.0.2
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @oclif/test@2.5.6 › @oclif/core@2.16.0 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5 › braces@3.0.2

Overview

braces is a Bash-like brace expansion, implemented in JavaScript.

Affected versions of this package are vulnerable to Uncontrolled resource consumption due to failing to limit the number of characters it can handle, through the parse function. An attacker can cause the application to allocate excessive memory and potentially crash by sending imbalanced braces as input.

Remediation

There is no fixed version for braces.

References

Uncontrolled resource consumption vulnerability report

high severity

new

Inefficient Regular Expression Complexity

Vulnerable module: micromatch
Introduced through: @oclif/core@1.26.2 and @salesforce/command@5.3.9

Detailed paths

Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @oclif/core@1.26.2 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @oclif/core@1.26.2 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @oclif/test@2.5.6 › @oclif/core@2.16.0 › globby@11.1.0 › fast-glob@3.3.2 › micromatch@4.0.5

Overview

Affected versions of this package are vulnerable to Inefficient Regular Expression Complexity due to the use of unsafe pattern configurations that allow greedy matching through the micromatch.braces() function. An attacker can cause the application to hang or slow down by passing a malicious payload that triggers extensive backtracking in regular expression processing.

Remediation

A fix was pushed into the master branch but not yet published.

References

Inefficient Regular Expression Complexity vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: inflight
Introduced through: @salesforce/core@3.36.2, @salesforce/source-deploy-retrieve@7.15.1 and others

Detailed paths

Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › unzipper@0.10.11 › fstream@1.0.12 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

Missing Release of Resource after Effective Lifetime vulnerability report

Vulnerabilities

Dependencies

Source

Commit

Find, fix and prevent vulnerabilities in your code.

critical severity

Remote Code Execution (RCE)

Detailed paths

Overview

Remediation

References

critical severity

Remote Code Execution (RCE)

Detailed paths

Overview

Remediation

References

high severity new

Uncontrolled resource consumption

Detailed paths

Overview

Remediation

References

high severity new

Inefficient Regular Expression Complexity

Detailed paths

Overview

Remediation

References

medium severity

Missing Release of Resource after Effective Lifetime

Detailed paths

Overview

PoC

Remediation

References

high severity

new

high severity

new