azure@2.0.0-preview

medium severity

• Vulnerable module: validator
• Introduced through: azure-common@0.9.18, azure-sb@0.10.4 and others

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-common@0.9.18 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-sb@0.10.4 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-storage@1.3.0 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-compute@0.17.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-hdinsight@0.10.3 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-mgmt@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-network@0.13.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-scheduler@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-sb@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-sql@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-store@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-storage@0.12.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-subscription@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-trafficmanager@0.10.4 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-arm-hdinsight@0.2.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-gallery@2.0.0-pre.20 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-website@0.10.5 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-monitoring@0.10.5 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-scheduler@0.10.3 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-arm-hdinsight-jobs@0.1.1 › azure-common@0.9.19 › validator@3.22.2

Overview

validator is String validation and sanitization. Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in IE9 due to unescaped backticks.

Remediation

Upgrade validator to version 3.35.0 or higher.

References

• GitHub Commit

medium severity

• Vulnerable module: moment
• Introduced through: azure-asm-website@0.10.5, azure-monitoring@0.10.5 and others

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-asm-website@0.10.5 › moment@2.14.1
• Introduced through: azure@2.0.0-preview › azure-monitoring@0.10.5 › moment@2.14.1
• Introduced through: azure@2.0.0-preview › azure-scheduler@0.10.3 › moment@2.14.1

Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of the package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks for any locale that has separate format and standalone options and format input can be controlled by the user.

An attacker can provide a specially crafted input to the format function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).

Disclosure Timeline

• October 19th, 2016 - Reported the issue to package owner.
• October 19th, 2016 - Issue acknowledged by package owner.
• October 24th, 2016 - Issue fixed and version 2.15.2 released.

References

• Proof of concept
• Fix commit

medium severity

• Vulnerable module: tunnel-agent
• Introduced through: azure-common@0.9.18 and azure-storage@1.3.0

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-common@0.9.18 › request@2.74.0 › tunnel-agent@0.4.3
• Introduced through: azure@2.0.0-preview › azure-storage@1.3.0 › request@2.74.0 › tunnel-agent@0.4.3

Overview

tunnel-agent is HTTP proxy tunneling agent.

Affected versions of the package are vulnerable to Uninitialized Memory Exposure. If a request uses a proxy.auth option with a numeric value X, then X bytes of uninitialized memory will be sent in the body of the request.

Details

Constructing a Buffer class with integer N creates a Buffer of length N with non zero-ed out memory. Example:

var x = new Buffer(100); // uninitialized Buffer of length 100
            // vs
            var x = new Buffer('100'); // initialized Buffer with value of '100'
            

Initializing a proxy.auth option in such manner will cause uninitialized memory to be sent in the body of the request.

Proof of concept by ChALkeR

require('request')({
              method: 'GET',
              uri: 'http://www.example.com',
              tunnel: true,
              proxy:{
                  protocol: 'http:',
                  host:"127.0.0.1",
                  port:8080,
                  auth:80
              }
            });
            

Remediation

Upgrade tunnel-agent to version 0.6.0 or higher.

References

• PoC by ChALkeR
• Github Commit