Find, fix and prevent vulnerabilities in your code.
critical severity
- Vulnerable module: vm2
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient checks which allow an attacker to escape the sandbox.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
Remediation
There is no fixed version for vm2
.
References
critical severity
- Vulnerable module: vm2
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise
handler sanitization can be bypassed, allowing attackers to escape the sandbox.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
Remediation
There is no fixed version for vm2
.
References
high severity
new
- Vulnerable module: pug-code-gen
- Introduced through: pug@3.0.3
Detailed paths
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › pug@3.0.3 › pug-code-gen@3.0.3
Overview
pug-code-gen is a Default code-generator for pug. It generates HTML via a JavaScript template function.
Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the name
option of the compileClient
, compileFileClient
, or compileClientWithDependenciesTracked
functions. An attacker can execute arbitrary JavaScript code by providing untrusted input.
Note:
These functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.
PoC
const express = require("express")
const pug = require("pug")
const runtimeWrap = require('pug-runtime/wrap');
const PORT = 3000
const app = express()
app.get("/", (req, res) => {
const out = runtimeWrap(pug.compileClient('string of pug', req.query))
res.send(out())
})
app.listen(PORT, () => {
console.log(`Server is running on port ${PORT}`)
})
Remediation
There is no fixed version for pug-code-gen
.
References
medium severity
new
- Vulnerable module: ip
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › ip@1.1.9
Overview
ip is a Node library.
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the isPublic
function, which identifies some private IP addresses as public addresses due to improper parsing of the input.
An attacker can manipulate a system that uses isLoopback()
, isPrivate()
and isPublic
functions to guard outgoing network requests to treat certain IP addresses as globally routable by supplying specially crafted IP addresses.
Note
This vulnerability derived from an incomplete fix for CVE-2023-42282
Remediation
There is no fixed version for ip
.
References
medium severity
- Vulnerable module: inflight
- Introduced through: @salesforce/core@3.36.2, @salesforce/source-deploy-retrieve@7.15.1 and others
Detailed paths
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › unzipper@0.10.11 › fstream@1.0.12 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: sf-codegen@dieffrei/sf-codegen#6a2936a6eb90439e21ba067c7711d6571011bd58 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
Overview
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres
function due to improperly deleting keys from the reqs
object after execution of callbacks. This behavior causes the keys to remain in the reqs
object, which leads to resource exhaustion.
Exploiting this vulnerability results in crashing the node
process or in the application crash.
Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.
To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.
PoC
const inflight = require('inflight');
function testInflight() {
let i = 0;
function scheduleNext() {
let key = `key-${i++}`;
const callback = () => {
};
for (let j = 0; j < 1000000; j++) {
inflight(key, callback);
}
setImmediate(scheduleNext);
}
if (i % 100 === 0) {
console.log(process.memoryUsage());
}
scheduleNext();
}
testInflight();
Remediation
There is no fixed version for inflight
.