azure@1.2.0-preview

Microsoft Azure Client Library for node.

Known vulnerabilities2
Vulnerable paths26
Dependencies183

Cross-site Scripting (XSS)

medium severity
  • Vulnerable module: validator
  • Introduced through: azure-common@0.9.18, azure-storage@1.3.0 and others

Detailed paths

  • Introduced through: azure@1.2.0-preview azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-storage@1.3.0 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-gallery@2.0.0-pre.20 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-compute@0.17.1 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-hdinsight@0.10.3 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-mgmt@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-storage@0.12.1 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-network@0.13.1 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-sb@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-sql@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-store@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-subscription@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-scheduler@0.10.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-trafficmanager@0.10.4 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-arm-commerce@0.1.2 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-arm-hdinsight@0.2.1 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-arm-trafficmanager@0.10.7 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-monitoring@0.10.4 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-scheduler@0.10.3 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-asm-website@0.10.5 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-arm-insights@0.11.4 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-sb@0.10.4 azure-common@0.9.18 validator@3.22.2
  • Introduced through: azure@1.2.0-preview azure-arm-hdinsight-jobs@0.1.1 azure-common@0.9.18 validator@3.22.2

Overview

validator is String validation and sanitization. Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in IE9 due to unescaped backticks.

Remediation

Upgrade validator to version 3.35.0 or higher.

References

Regular Expression Denial of Service

medium severity
  • Vulnerable module: moment
  • Introduced through: azure-monitoring@0.10.4, azure-scheduler@0.10.3 and others

Detailed paths

  • Introduced through: azure@1.2.0-preview azure-monitoring@0.10.4 moment@2.14.1
  • Introduced through: azure@1.2.0-preview azure-scheduler@0.10.3 moment@2.14.1
  • Introduced through: azure@1.2.0-preview azure-asm-website@0.10.5 moment@2.14.1

Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of the package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks for any locale that has separate format and standalone options and format input can be controlled by the user.

An attacker can provide a specially crafted input to the format function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).

Disclosure Timeline

  • October 19th, 2016 - Reported the issue to package owner.
  • October 19th, 2016 - Issue acknowledged by package owner.
  • October 24th, 2016 - Issue fixed and version 2.15.2 released.

References