Find, fix and prevent vulnerabilities in your code.
critical severity
- Vulnerable module: yarn
- Introduced through: yarn@1.2.1
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › yarn@1.2.1Remediation: Upgrade to yarn@1.19.0.
Overview
yarn is a package for dependency management.
Affected versions of this package are vulnerable to Improper Integrity Checks. It allows to pollute yarn cache via a crafted yarn.lock
file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock
so that any future installs of that package will install the fake version (regardless of integrity and hashes).
Remediation
Upgrade yarn
to version 1.19 or higher.
References
high severity
- Vulnerable module: yarn
- Introduced through: yarn@1.2.1
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › yarn@1.2.1Remediation: Upgrade to yarn@1.17.3.
Overview
yarn is a package for dependency management.
Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Npm credentials such as _authToken
were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably positioned attacker to eavesdrop and compromise the sent credentials.
Remediation
Upgrade yarn
to version 1.17.3 or higher.
References
high severity
- Vulnerable module: ajv
- Introduced through: ng2-pdf-viewer@4.1.2
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › ng2-pdf-viewer@4.1.2 › pdfjs-dist@1.9.489 › worker-loader@0.8.1 › schema-utils@0.3.0 › ajv@5.5.2Remediation: Upgrade to ng2-pdf-viewer@5.0.1.
Overview
ajv is an Another JSON Schema Validator
Affected versions of this package are vulnerable to Prototype Pollution. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__
, constructor
and prototype
. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype
are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Object
recursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__
defined with Object.defineProperty()
, the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object
and the source of Object
as defined by the attacker. Properties are then copied on the Object
prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source)
.
lodash
and Hoek
are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue
. myValue
is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
Type | Origin | Short description |
---|---|---|
Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf ). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object . In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr) . In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin , then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true , they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype)
.Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)
), breaking the prototype chain and preventing pollution.As a best practice use
Map
instead ofObject
.
For more information on this vulnerability type:
Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade ajv
to version 6.12.3 or higher.
References
high severity
- Vulnerable module: yarn
- Introduced through: yarn@1.2.1
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › yarn@1.2.1Remediation: Upgrade to yarn@1.22.13.
Overview
yarn is a package for dependency management.
Affected versions of this package are vulnerable to Untrusted Search Path. An attacker can execute arbitrary code by placing a malicious executable file in a directory that is then searched by the victim running certain commands.
Note: This is only exploitable on Windows.
Remediation
Upgrade yarn
to version 1.22.13 or higher.
References
high severity
- Vulnerable module: pdfjs-dist
- Introduced through: ng2-pdf-viewer@4.1.2 and pdfjs-dist@1.9.661
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › ng2-pdf-viewer@4.1.2 › pdfjs-dist@1.9.489Remediation: Upgrade to ng2-pdf-viewer@5.2.2.
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › pdfjs-dist@1.9.661Remediation: Upgrade to pdfjs-dist@2.0.943.
Overview
pdfjs-dist is a Portable Document Format (PDF) library that is built with HTML5.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker.
Details
A cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.
This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.
Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.
Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, <
can be coded as <
; and >
can be coded as >
; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses <
and >
as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.
The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.
Types of attacks
There are a few methods by which XSS can be manipulated:
Type | Origin | Description |
---|---|---|
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link. |
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser. |
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data. |
Mutated | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters. |
Affected environments
The following environments are susceptible to an XSS attack:
- Web servers
- Application servers
- Web application environments
How to prevent
This section describes the top best practices designed to specifically protect your code:
- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as
?
,&
,/
,<
,>
and spaces to their respective HTML or URL encoded equivalents. - Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.
Remediation
Upgrade pdfjs-dist
to version 2.0.943 or higher.
References
medium severity
- Vulnerable module: yarn
- Introduced through: yarn@1.2.1
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › yarn@1.2.1Remediation: Upgrade to yarn@1.22.0.
Overview
yarn is a package for dependency management.
Affected versions of this package are vulnerable to Arbitrary File Overwrite. It is possible for a malicious package, upon install, to write to any path on the filesystem even when the --ignore-scripts
option is set. This occurs due to symlinks not being correctly unpacked as part of the Yarn install process.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st
is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public
route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e
is the URL encoded version of .
(dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip
.
One way to achieve this is by using a malicious zip
archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip
archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/
overwriting the authorized_keys
file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade yarn
to version 1.22.0 or higher.
References
low severity
- Vulnerable module: @angular/core
- Introduced through: @angular/core@5.2.11
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › @angular/core@5.2.11Remediation: Upgrade to @angular/core@11.0.5.
Overview
@angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in development, with SSR enabled.
Details
A cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.
This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.
Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.
Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, <
can be coded as <
; and >
can be coded as >
; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses <
and >
as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.
The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.
Types of attacks
There are a few methods by which XSS can be manipulated:
Type | Origin | Description |
---|---|---|
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link. |
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser. |
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data. |
Mutated | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters. |
Affected environments
The following environments are susceptible to an XSS attack:
- Web servers
- Application servers
- Web application environments
How to prevent
This section describes the top best practices designed to specifically protect your code:
- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as
?
,&
,/
,<
,>
and spaces to their respective HTML or URL encoded equivalents. - Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.
Remediation
Upgrade @angular/core
to version 11.0.5, 11.1.0-next.3 or higher.
References
low severity
- Vulnerable module: yarn
- Introduced through: yarn@1.2.1
Detailed paths
-
Introduced through: em-viewer-web@hmcts/em-viewer-web#7bd28e6d6a1312c904c85c79f1f788590856e5ea › yarn@1.2.1Remediation: Upgrade to yarn@1.21.1.
Overview
yarn is a package for dependency management.
Affected versions of this package are vulnerable to Arbitrary File Write. The package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted bin
keys. Existing files could be overwritten depending on the current user permission set.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st
is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public
route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e
is the URL encoded version of .
(dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip
.
One way to achieve this is by using a malicious zip
archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip
archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/
overwriting the authorized_keys
file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade yarn
to version 1.21.1 or higher.