<p>There is no fixed version for <code>access-policy</code>.</p>

Arbitrary Code Execution Affecting access-policy package, versions *

Snyk CVSS

Attack Complexity Low

Confidentiality High

Threat Intelligence

Exploit Maturity Proof of concept

EPSS 6.86% (94^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-ACCESSPOLICY-571490
published 5 Jun 2020
disclosed 5 Jun 2020
credit JHU System Security Lab

Report a new vulnerability Found a mistake?

Introduced: 5 Jun 2020

CVE-2020-7674 Open this link in a new tab CWE-78 Open this link in a new tab First added by Snyk

How to fix?

There is no fixed version for access-policy.

Overview

access-policy is a package that encodes and decodes policy JSON files for use with web applications.

Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution.

PoC

var a = require("access-policy");
var statements = '`;console.log(123);//';
data = {};

a.encode(statements,data)

References

Vulnerable Code