Vulnerabilities

 2 via 2 paths

Dependencies

 159

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

medium severity
new

NULL Pointer Dereference

  • Vulnerable module: qs
  • Introduced through: @cypress/request@3.0.10

Detailed paths

  • Introduced through: foaas@doomcrewinc/foaas › @cypress/request@3.0.10 › qs@6.14.2

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to NULL Pointer Dereference in the stringify() function, when processing arrays with the options arrayFormat: 'comma' and encodeValuesOnly: true that contain null or undefined elements. An attacker can cause errors by supplying mailcious input that results in these options being used with arrays containing null or undefined values. This only causes a crash if application code makes calls outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or explicitly disables framework error handling.

PoC

const qs = require('qs');

qs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });

Remediation

Upgrade qs to version 6.15.2 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Improper Validation of Specified Index, Position, or Offset in Input

  • Vulnerable module: uuid
  • Introduced through: @cypress/request@3.0.10

Detailed paths

  • Introduced through: foaas@doomcrewinc/foaas › @cypress/request@3.0.10 › uuid@8.3.2
    Remediation: Upgrade to @cypress/request@4.0.0.

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

Improper Validation of Specified Index, Position, or Offset in Input vulnerability report