azure@2.0.0-preview

medium severity

• Vulnerable module: validator
• Introduced through: azure-common@0.9.18, azure-sb@0.10.4 and others

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-common@0.9.18 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-sb@0.10.4 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-storage@1.3.0 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-compute@0.17.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-hdinsight@0.10.3 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-mgmt@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-network@0.13.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-scheduler@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-sb@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-sql@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-store@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-storage@0.12.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-subscription@0.10.2 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-trafficmanager@0.10.4 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-arm-hdinsight@0.2.1 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-gallery@2.0.0-pre.20 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-asm-website@0.10.5 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-monitoring@0.10.5 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-scheduler@0.10.3 › azure-common@0.9.19 › validator@3.22.2
• Introduced through: azure@2.0.0-preview › azure-arm-hdinsight-jobs@0.1.1 › azure-common@0.9.19 › validator@3.22.2

Overview

validator is String validation and sanitization. Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in IE9 due to unescaped backticks.

Remediation

Upgrade validator to version 3.35.0 or higher.

References

• GitHub Commit

medium severity

• Vulnerable module: moment
• Introduced through: azure-asm-website@0.10.5, azure-monitoring@0.10.5 and others

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-asm-website@0.10.5 › moment@2.14.1
• Introduced through: azure@2.0.0-preview › azure-monitoring@0.10.5 › moment@2.14.1
• Introduced through: azure@2.0.0-preview › azure-scheduler@0.10.3 › moment@2.14.1

Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of the package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks for any locale that has separate format and standalone options and format input can be controlled by the user.

An attacker can provide a specially crafted input to the format function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).

Disclosure Timeline

• October 19th, 2016 - Reported the issue to package owner.
• October 19th, 2016 - Issue acknowledged by package owner.
• October 24th, 2016 - Issue fixed and version 2.15.2 released.

References

• Proof of concept
• Fix commit

medium severity

• Vulnerable module: tunnel-agent
• Introduced through: azure-common@0.9.18 and azure-storage@1.3.0

Detailed paths

• Introduced through: azure@2.0.0-preview › azure-common@0.9.18 › request@2.74.0 › tunnel-agent@0.4.3
• Introduced through: azure@2.0.0-preview › azure-storage@1.3.0 › request@2.74.0 › tunnel-agent@0.4.3

Overview

tunnel-agent is HTTP proxy tunneling agent. Affected versions of the package are vulnerable to Uninitialized Memory Exposure.

A possible memory disclosure vulnerability exists when a value of type number is used to set the proxy.auth option of a request request and results in a possible uninitialized memory exposures in the request body.

This is a result of unobstructed use of the Buffer constructor, whose insecure default constructor increases the odds of memory leakage.

Details

Constructing a Buffer class with integer N creates a Buffer of length N with raw (not "zero-ed") memory.

In the following example, the first call would allocate 100 bytes of memory, while the second example will allocate the memory needed for the string "100":

// uninitialized Buffer of length 100
            x = new Buffer(100);
            // initialized Buffer with value of '100'
            x = new Buffer('100');
            

tunnel-agent's request construction uses the default Buffer constructor as-is, making it easy to append uninitialized memory to an existing list. If the value of the buffer list is exposed to users, it may expose raw server side memory, potentially holding secrets, private data and code. This is a similar vulnerability to the infamous Heartbleed flaw in OpenSSL.

Proof of concept by ChALkeR

require('request')({
              method: 'GET',
              uri: 'http://www.example.com',
              tunnel: true,
              proxy:{
                  protocol: 'http:',
                  host:"127.0.0.1",
                  port:8080,
                  auth:80
              }
            });
            

You can read more about the insecure Buffer behavior on our blog.

Similar vulnerabilities were discovered in request, mongoose, ws and sequelize.

Remediation

Upgrade tunnel-agent to version 0.6.0 or higher.

References

• PoC by ChALkeR
• Github Commit