Find, fix and prevent vulnerabilities in your code.
critical severity
- Vulnerable module: vm2
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient checks which allow an attacker to escape the sandbox.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
Remediation
There is no fixed version for vm2
.
References
critical severity
- Vulnerable module: vm2
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise
handler sanitization can be bypassed, allowing attackers to escape the sandbox.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
Remediation
There is no fixed version for vm2
.
References
medium severity
new
- Vulnerable module: tmp
- Introduced through: inquirer@8.2.4, jsforce@2.0.0-beta.29 and others
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › inquirer@8.2.4 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/core@3.36.2 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/apex-node@2.1.7 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/apex-node@2.1.7 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/sf-plugins-core@5.0.13 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/source-deploy-retrieve@10.9.1 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/source-tracking@5.2.4 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/plugin-source@2.11.4 › @salesforce/source-tracking@5.2.4 › @salesforce/source-deploy-retrieve@10.9.1 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
Overview
Affected versions of this package are vulnerable to Symlink Attack via the dir
parameter. An attacker can cause files or directories to be written to arbitrary locations by supplying a crafted symbolic link that resolves outside the intended temporary directory.
PoC
const tmp = require('tmp');
const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);
try {
tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
console.log('test 1:', err.message)
}
try {
tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
console.log('test 2:', err.message)
}
try {
const fs = require('node:fs');
const resolved = fs.realpathSync('/tmp/evil-dir');
tmp.fileSync({ 'dir': resolved});
} catch (err) {
console.log('test 3:', err.message)
}
Remediation
Upgrade tmp
to version 0.2.4 or higher.
References
medium severity
- Vulnerable module: ip
- Introduced through: @salesforce/source-deploy-retrieve@7.15.1
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › ip@1.1.9
Overview
ip is a Node library.
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the isPublic
function, which identifies some private IP addresses as public addresses due to improper parsing of the input.
An attacker can manipulate a system that uses isLoopback()
, isPrivate()
and isPublic
functions to guard outgoing network requests to treat certain IP addresses as globally routable by supplying specially crafted IP addresses.
Note
This vulnerability derived from an incomplete fix for CVE-2023-42282
Remediation
There is no fixed version for ip
.
References
medium severity
- Vulnerable module: inflight
- Introduced through: @salesforce/core@3.36.2, @salesforce/source-deploy-retrieve@7.15.1 and others
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/command@5.3.9 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › unzipper@0.10.11 › fstream@1.0.12 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › @salesforce/kit@1.9.2 › shx@0.3.4 › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/command@5.3.9 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › @salesforce/source-deploy-retrieve@7.15.1 › @salesforce/core@3.36.2 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
Overview
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres
function due to improperly deleting keys from the reqs
object after execution of callbacks. This behavior causes the keys to remain in the reqs
object, which leads to resource exhaustion.
Exploiting this vulnerability results in crashing the node
process or in the application crash.
Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.
To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.
PoC
const inflight = require('inflight');
function testInflight() {
let i = 0;
function scheduleNext() {
let key = `key-${i++}`;
const callback = () => {
};
for (let j = 0; j < 1000000; j++) {
inflight(key, callback);
}
setImmediate(scheduleNext);
}
if (i % 100 === 0) {
console.log(process.memoryUsage());
}
scheduleNext();
}
testInflight();
Remediation
There is no fixed version for inflight
.
References
medium severity
- Vulnerable module: xml2js
- Introduced through: xml2js@0.4.23
Detailed paths
-
Introduced through: @gaelmotte/gmotte-sfdx-plugin@gaelmotte/sfdx-gmotte-plugin#235e5192966c8d04c04eaee83479e3a727c16110 › xml2js@0.4.23Remediation: Upgrade to xml2js@0.5.0.
Overview
Affected versions of this package are vulnerable to Prototype Pollution due to allowing an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__
property to be edited.
PoC
var parseString = require('xml2js').parseString;
let normal_user_request = "<role>admin</role>";
let malicious_user_request = "<__proto__><role>admin</role></__proto__>";
const update_user = (userProp) => {
// A user cannot alter his role. This way we prevent privilege escalations.
parseString(userProp, function (err, user) {
if(user.hasOwnProperty("role") && user?.role.toLowerCase() === "admin") {
console.log("Unauthorized Action");
} else {
console.log(user?.role[0]);
}
});
}
update_user(normal_user_request);
update_user(malicious_user_request);
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__
, constructor
and prototype
. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype
are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Object
recursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__
defined with Object.defineProperty()
, the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object
and the source of Object
as defined by the attacker. Properties are then copied on the Object
prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source)
.
lodash
and Hoek
are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue
. myValue
is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
Type | Origin | Short description |
---|---|---|
Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf ). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object . In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr) . In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin , then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true , they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype)
.Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)
), breaking the prototype chain and preventing pollution.As a best practice use
Map
instead ofObject
.
For more information on this vulnerability type:
Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade xml2js
to version 0.5.0 or higher.