sharonkoch / nodegoat_demo

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

NodeGoat

Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

Getting Started

OWASP Top 10 for Node.js web applications:

Know it!

Tutorial Guide explaining how each of the OWASP Top 10 vulnerabilities can manifest in Node.js web apps and how to prevent it.

Do it!

A Vulnerable Node.js App for Ninjas to exploit, toast, and fix. You may like to set up your own copy of the app to fix and test vulnerabilities. Hint: Look for comments in the source code.

Default user accounts

The database comes pre-populated with these user accounts created as part of the seed data -

• Admin Account - u:admin p:Admin_123
• User Accounts (u:user1 p:User1_123), (u:user2 p:User2_123)
• New users can also be added using the sign-up page.

How to Set Up Your Copy of NodeGoat

OPTION 1 - Run NodeGoat on your machine

1. Install Node.js - NodeGoat requires Node v8 or above

2. Clone the github repository:

   git clone https://github.com/OWASP/NodeGoat.git
   

3. Go to the directory:

   cd NodeGoat
   

4. Install node packages:

   npm install
   

5. Set up MongoDB. You can either install MongoDB locally or create a remote instance:

   • Using local MongoDB:

     1. Install MongoDB Community Server
     2. Start mongod

   • Using remote MongoDB instance:

     1. Deploy a MongoDB Atlas free tier cluster (M0 Sandbox)
     2. Enable network access to the cluster from your current IP address
     3. Add a database user to the cluster
     4. Set the MONGODB_URI environment variable to the connection string of your cluster, which can be viewed in the cluster's connect dialog. Select "Connect your application", set the driver to "Node.js" and the version to "2.2.12 or later". This will give a connection string in the form:

        mongodb://<username>:<password>@<cluster>/<dbname>?ssl=true&replicaSet=<rsname>&authSource=admin&retryWrites=true&w=majority
        

        The <username> and <password> fields need filling in with the details of the database user added earlier. The <dbname> field sets the name of the database nodegoat will use in the cluster (eg "nodegoat"). The other fields will already be filled in with the correct details for your cluster.

6. Populate MongoDB with the seed data required for the app:

   npm run db:seed
   

   By default this will use the "development" configuration, but the desired config can be passed as an argument if required.

7. Start the server. You can run the server using node or nodemon:

   • Start the server with node. This starts the NodeGoat application at http://localhost:4000/:

     npm start
     

   • Start the server with nodemon, which will automatically restart the application when you make any changes. This starts the NodeGoat application at http://localhost:5000/:

     npm run dev
     

Customizing the Default Application Configuration

By default the application will be hosted on port 4000 and will connect to a MongoDB instance at localhost:27017. To change this set the environment variables PORT and MONGODB_URI.

Other settings can be changed by updating the config file.

OPTION 2 - Run NodeGoat on Docker

The repo includes the Dockerfile and docker-compose.yml necessary to set up the app and db instance, then connect them together.

1. Install docker and docker compose

2. Clone the github repository:

   git clone https://github.com/OWASP/NodeGoat.git
   

3. Go to the directory:

   cd NodeGoat
   

4. Build the images:

   docker-compose build
   

5. Run the app, this starts the NodeGoat application at http://localhost:4000/:

   docker-compose up
   

OPTION 3 - Deploy to Heroku

This option uses a free ($0/month) Heroku node server.

Though not essential, it is recommended that you fork this repository and deploy the forked repo. This will allow you to fix vulnerabilities in your own forked version, then deploy and test it on Heroku.

1. Set up a publicly accessible MongoDB instance:

   1. Deploy a MongoDB Atlas free tier cluster (M0 Sandbox)
   2. Enable network access to the cluster from anywhere (CIDR range 0.0.0.0/0)
   3. Add a database user to the cluster

2. Deploy NodeGoat to Heroku by clicking the button below:

   

   In the Create New App dialog, set the MONGODB_URI config var to the connection string of your MongoDB Atlas cluster. This can be viewed in the cluster's connect dialog. Select "Connect your application", set the driver to "Node.js" and the version to "2.2.12 or later". This will give a connection string in the form:

   mongodb://<username>:<password>@<cluster>/<dbname>?ssl=true&replicaSet=<rsname>&authSource=admin&retryWrites=true&w=majority
   

   The <username> and <password> fields need filling in with the details of the database user added earlier. The <dbname> field sets the name of the database nodegoat will use in the cluster (eg "nodegoat"). The other fields will already be filled in with the correct details for your cluster.

Report bugs, Feedback, Comments

• Open a new issue or contact team by joining chat at Slack or

Contributing

Please Follow the contributing guide

Code Of Conduct (CoC)

This project is bound by a Code of Conduct.

Contributors

Here are the amazing contributors to the NodeGoat project.

Supports

• Thanks to JetBrains for providing licenses to fantastic WebStorm IDE to build this project.

License

Code licensed under the Apache License v2.0.

nodegoat_demo's Issues

body-parser-1.18.3.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - body-parser-1.18.3.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (body-parser version)	Remediation Possible**
CVE-2024-45590	High	7.5	body-parser-1.18.3.tgz	Direct	body-parser - 1.20.3	✅
CVE-2022-24999	High	7.5	qs-6.5.2.tgz	Transitive	1.19.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-45590

Vulnerable Library - body-parser-1.18.3.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ body-parser-1.18.3.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Publish Date: 2024-09-10

URL: CVE-2024-45590

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qwcr-r2fm-qrc7

Release Date: 2024-09-10

Fix Resolution: body-parser - 1.20.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (body-parser): 1.19.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

mongodb-2.2.36.tgz: 4 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - mongodb-2.2.36.tgz

The official MongoDB driver for Node.js

Library home page: https://registry.npmjs.org/mongodb/-/mongodb-2.2.36.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (mongodb version)	Remediation Possible**
CVE-2020-7610	Critical	9.8	bson-1.0.9.tgz	Transitive	3.1.3	✅
WS-2019-0311	Medium	6.5	mongodb-2.2.36.tgz	Direct	3.1.13	✅
CVE-2022-25883	Medium	5.3	semver-5.6.0.tgz	Transitive	3.6.6	✅
CVE-2019-2391	Medium	4.2	bson-1.0.9.tgz	Transitive	3.1.3	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-7610

Vulnerable Library - bson-1.0.9.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.0.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mongodb-2.2.36.tgz (Root Library)
  • mongodb-core-2.1.20.tgz
    • ❌ bson-1.0.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Publish Date: 2020-03-30

URL: CVE-2020-7610

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-04-01

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.1.3

⛑️ Automatic Remediation will be attempted for this issue.

WS-2019-0311

Vulnerable Library - mongodb-2.2.36.tgz

The official MongoDB driver for Node.js

Library home page: https://registry.npmjs.org/mongodb/-/mongodb-2.2.36.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ mongodb-2.2.36.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

In 'node-mongodb-native', versions prior to v3.1.13 are vulnerable against DOS as a result of a potential crash when a collection name is invalid and the DB doesn't exist.

Publish Date: 2019-01-23

URL: WS-2019-0311

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1203

Release Date: 2019-01-23

Fix Resolution: 3.1.13

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Library - semver-5.6.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mongodb-2.2.36.tgz (Root Library)
  • mongodb-core-2.1.20.tgz
    • require_optional-1.0.1.tgz
      • ❌ semver-5.6.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (mongodb): 3.6.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-2391

Vulnerable Library - bson-1.0.9.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.0.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mongodb-2.2.36.tgz (Root Library)
  • mongodb-core-2.1.20.tgz
    • ❌ bson-1.0.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Publish Date: 2020-03-31

URL: CVE-2019-2391

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2391

Release Date: 2020-03-31

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.1.3

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

swig-1.4.2.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - swig-1.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (swig version)	Remediation Possible**
CVE-2015-8858	High	7.5	uglify-js-2.4.24.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2015-8858

Vulnerable Library - uglify-js-2.4.24.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.4.24.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• swig-1.4.2.tgz (Root Library)
  • ❌ uglify-js-2.4.24.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Publish Date: 2017-01-23

URL: CVE-2015-8858

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2017-01-23

Fix Resolution: v2.6.0

marked-0.3.9.tgz: 5 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (marked version)	Remediation Possible**
CVE-2022-21681	High	7.5	marked-0.3.9.tgz	Direct	4.0.10	✅
CVE-2022-21680	High	7.5	marked-0.3.9.tgz	Direct	4.0.10	✅
WS-2020-0163	Medium	5.9	marked-0.3.9.tgz	Direct	1.1.1	✅
WS-2019-0027	Medium	5.3	marked-0.3.9.tgz	Direct	0.3.18	✅
WS-2018-0628	Medium	5.3	marked-0.3.9.tgz	Direct	0.4.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-21681

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ marked-0.3.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21681

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v2h-r2cx-5xgj

Release Date: 2022-01-14

Fix Resolution: 4.0.10

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-21680

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ marked-0.3.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21680

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rrrm-qjm4-v8hf

Release Date: 2022-01-14

Fix Resolution: 4.0.10

⛑️ Automatic Remediation will be attempted for this issue.

WS-2020-0163

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ marked-0.3.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.

Publish Date: 2020-07-02

URL: WS-2020-0163

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution: 1.1.1

⛑️ Automatic Remediation will be attempted for this issue.

WS-2019-0027

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ marked-0.3.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.

Publish Date: 2018-02-26

URL: WS-2019-0027

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-02-26

Fix Resolution: 0.3.18

⛑️ Automatic Remediation will be attempted for this issue.

WS-2018-0628

Vulnerable Library - marked-0.3.9.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ marked-0.3.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

marked before 0.4.0 is vulnerable to Regular Expression Denial of Service (REDoS) through heading in marked.js.

Publish Date: 2018-04-16

URL: WS-2018-0628

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-04-16

Fix Resolution: 0.4.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

express-4.16.4.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - express-4.16.4.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.16.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (express version)	Remediation Possible**
CVE-2024-45296	High	7.5	path-to-regexp-0.1.7.tgz	Transitive	N/A*	❌
CVE-2024-29041	Medium	6.1	express-4.16.4.tgz	Direct	4.19.0	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-45296

Vulnerable Library - path-to-regexp-0.1.7.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• express-4.16.4.tgz (Root Library)
  • ❌ path-to-regexp-0.1.7.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution: path-to-regexp - 0.1.10,8.0.0

CVE-2024-29041

Vulnerable Library - express-4.16.4.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.16.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ express-4.16.4.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

underscore-1.9.1.tgz: 1 vulnerabilities (highest severity is: 3.3)

Vulnerable Library - underscore-1.9.1.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (underscore version)	Remediation Possible**
CVE-2021-23358	Low	3.3	underscore-1.9.1.tgz	Direct	1.12.1	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23358

Vulnerable Library - underscore-1.9.1.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ underscore-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: 1.12.1

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

helmet-2.3.0.tgz: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - helmet-2.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (helmet version)	Remediation Possible**
WS-2019-0289	Medium	6.1	helmet-csp-1.2.2.tgz	Transitive	3.21.0	✅
CVE-2017-20162	Medium	4.3	ms-0.7.1.tgz	Transitive	3.6.1	✅
CVE-2017-16137	Low	3.7	debug-2.2.0.tgz	Transitive	3.8.2	✅
CVE-2017-20165	Low	3.5	debug-2.2.0.tgz	Transitive	3.8.2	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2019-0289

Vulnerable Library - helmet-csp-1.2.2.tgz

Content Security Policy middleware.

Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-1.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • ❌ helmet-csp-1.2.2.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.

Publish Date: 2019-11-18

URL: WS-2019-0289

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1176

Release Date: 2019-11-18

Fix Resolution (helmet-csp): 2.9.1

Direct dependency fix Resolution (helmet): 3.21.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2017-20162

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • connect-3.4.1.tgz
    • debug-2.2.0.tgz
      • ❌ ms-0.7.1.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.

Publish Date: 2023-01-05

URL: CVE-2017-20162

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-05

Fix Resolution (ms): 2.0.0

Direct dependency fix Resolution (helmet): 3.6.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2017-16137

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • connect-3.4.1.tgz
    • ❌ debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-04-26

URL: CVE-2017-16137

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution (debug): 2.6.9

Direct dependency fix Resolution (helmet): 3.8.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2017-20165

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • connect-3.4.1.tgz
    • ❌ debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Publish Date: 2023-01-09

URL: CVE-2017-20165

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9vvw-cc9w-f27h

Release Date: 2023-01-09

Fix Resolution (debug): 2.6.9

Direct dependency fix Resolution (helmet): 3.8.2

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

forever-2.0.0.tgz: 26 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - forever-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (forever version)	Remediation Possible**
MSC-2023-16609	Critical	9.8	fsevents-1.2.9.tgz	Transitive	N/A*	❌
CVE-2023-45311	Critical	9.8	fsevents-1.2.9.tgz	Transitive	3.0.0	✅
CVE-2021-44906	Critical	9.8	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2019-10747	Critical	9.8	detected in multiple dependencies	Transitive	3.0.0	✅
CVE-2019-10746	Critical	9.8	mixin-deep-1.3.1.tgz	Transitive	3.0.0	✅
CVE-2021-37713	High	8.2	tar-4.4.8.tgz	Transitive	3.0.0	✅
CVE-2021-37712	High	8.2	tar-4.4.8.tgz	Transitive	3.0.0	✅
CVE-2021-37701	High	8.2	tar-4.4.8.tgz	Transitive	3.0.0	✅
CVE-2021-32804	High	8.2	tar-4.4.8.tgz	Transitive	3.0.0	✅
CVE-2021-32803	High	8.2	tar-4.4.8.tgz	Transitive	3.0.0	✅
WS-2018-0148	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-4068	High	7.5	braces-2.3.2.tgz	Transitive	N/A*	❌
CVE-2022-38900	High	7.5	decode-uri-component-0.2.0.tgz	Transitive	3.0.0	✅
CVE-2022-3517	High	7.5	minimatch-3.0.4.tgz	Transitive	N/A*	❌
CVE-2021-3820	High	7.5	i-0.3.6.tgz	Transitive	3.0.0	✅
CVE-2019-20149	High	7.5	kind-of-6.0.2.tgz	Transitive	3.0.0	✅
CVE-2022-21803	High	7.3	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2021-23440	High	7.3	detected in multiple dependencies	Transitive	3.0.0	✅
CVE-2020-7788	High	7.3	ini-1.3.5.tgz	Transitive	3.0.0	✅
CVE-2020-7774	High	7.3	y18n-3.2.1.tgz	Transitive	3.0.0	✅
CVE-2024-28863	Medium	6.5	tar-4.4.8.tgz	Transitive	N/A*	❌
CVE-2020-7598	Medium	5.6	detected in multiple dependencies	Transitive	3.0.0	✅
CVE-2024-4067	Medium	5.3	micromatch-3.1.10.tgz	Transitive	N/A*	❌
CVE-2022-25883	Medium	5.3	semver-5.7.0.tgz	Transitive	3.0.0	✅
CVE-2020-28469	Medium	5.3	glob-parent-3.1.0.tgz	Transitive	N/A*	❌
CVE-2017-16137	Low	3.7	debug-4.1.1.tgz	Transitive	3.0.0	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (20 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

MSC-2023-16609

Vulnerable Library - fsevents-1.2.9.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • ❌ fsevents-1.2.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Publish Date: 2023-09-20

URL: MSC-2023-16609

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-45311

Vulnerable Library - fsevents-1.2.9.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • ❌ fsevents-1.2.9.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Publish Date: 2023-10-06

URL: CVE-2023-45311

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311

Release Date: 2023-10-06

Fix Resolution (fsevents): 1.2.11

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44906

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.5.tgz, minimist-0.0.10.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • mkdirp-0.5.1.tgz
            • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • prettyjson-1.2.1.tgz
    • ❌ minimist-1.2.5.tgz (Vulnerable Library)

minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • optimist-0.6.1.tgz
    • ❌ minimist-0.0.10.tgz (Vulnerable Library)

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • rc-1.2.8.tgz
            • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution: minimist - 0.2.4,1.2.6

CVE-2019-10747

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • union-value-1.0.0.tgz
                • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (forever): 3.0.0

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-10746

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • ❌ mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (mixin-deep): 1.3.2

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37713

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37712

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37701

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32804

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 4.4.14

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32803

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 4.4.15

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2018-0148

Vulnerable Libraries - utile-0.2.1.tgz, utile-0.3.0.tgz

utile-0.2.1.tgz

A drop-in replacement for `util` with some additional advantageous functions

Library home page: https://registry.npmjs.org/utile/-/utile-0.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • broadway-0.3.6.tgz
      • ❌ utile-0.2.1.tgz (Vulnerable Library)

utile-0.3.0.tgz

A drop-in replacement for `util` with some additional advantageous functions

Library home page: https://registry.npmjs.org/utile/-/utile-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • ❌ utile-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The utile npm module, version 0.3.0, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).

Publish Date: 2018-07-16

URL: WS-2018-0148

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0148

Release Date: 2018-01-16

Fix Resolution: JetBrains.Rider.Frontend5 - 213.0.20211008.154703-eap03

CVE-2024-4068

Vulnerable Library - braces-2.3.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • ❌ braces-2.3.2.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • source-map-resolve-0.5.2.tgz
            • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-3517

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2021-3820

Vulnerable Library - i-0.3.6.tgz

custom inflections for nodejs

Library home page: https://registry.npmjs.org/i/-/i-0.3.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • utile-0.3.0.tgz
    • ❌ i-0.3.6.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

inflect is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-27

URL: CVE-2021-3820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3820

Release Date: 2021-09-27

Fix Resolution (i): 0.3.7

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-12-30

Fix Resolution (kind-of): 6.0.3

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-21803

Vulnerable Libraries - nconf-0.6.9.tgz, nconf-0.10.0.tgz

nconf-0.6.9.tgz

Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.

Library home page: https://registry.npmjs.org/nconf/-/nconf-0.6.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • broadway-0.3.6.tgz
      • ❌ nconf-0.6.9.tgz (Vulnerable Library)

nconf-0.10.0.tgz

Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.

Library home page: https://registry.npmjs.org/nconf/-/nconf-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • ❌ nconf-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

Publish Date: 2022-04-12

URL: CVE-2022-21803

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21803

Release Date: 2022-04-12

Fix Resolution: nconf - 0.11.4

CVE-2021-23440

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • braces-2.3.2.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • union-value-1.0.0.tgz
                • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value before versions 2.0.1, 4.0.1 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/

Release Date: 2021-09-12

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (forever): 3.0.0

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7788

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • forever-monitor-2.0.0.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • rc-1.2.8.tgz
            • ❌ ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• forever-2.0.0.tgz (Root Library)
  • nconf-0.10.0.tgz
    • yargs-3.32.0.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in HEAD commit: fd59c7eced01a7615b89ff19959a525e3b9dad49

Found in base branch: master

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 3.2.2

Direct dependency fix Resolution (forever): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

Code Security Report: 11 high severity findings, 12 total findings

Code Security Report

Scan Metadata

Latest Scan: 2024-06-17 06:34am
Total Findings: 12 | New Findings: 4 | Resolved Findings: 3
Tested Project Files: 46
Detected Programming Languages: 1 (JavaScript / TypeScript*)

• Check this box to manually trigger a scan

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

Automatic Remediation Available (1)

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	Path/Directory Traversal	CWE-22	index.js:88	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/index.js Lines 83 to 88 in d950a24 app.get("/tutorial/:page", (req, res) => { const { page } = req.params return res.render(`tutorial/${page}`, { 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 84 in d950a24 app.get("/tutorial/:page", (req, res) => { NodeGoat_Demo/app/routes/index.js Line 86 in d950a24 page NodeGoat_Demo/app/routes/index.js Line 88 in d950a24 return res.render(`tutorial/${page}`, { ⛑️ Remediation Suggestion NodeGoat_Demo/diffs/84586edd-b718-4ef7-85d0-6b08d0408bc1/index.js.diff Lines 1 to 113 in e89304a --- original +++ remediated @@ -1,0 +1,1 @@ +const path = require('path') const SessionHandler = require("./session"); const ProfileHandler = require("./profile"); const BenefitsHandler = require("./benefits"); const ContributionsHandler = require("./contributions"); const AllocationsHandler = require("./allocations"); const MemosHandler = require("./memos"); const ResearchHandler = require("./research"); const { environmentalScripts } = require("../../config/config"); const ErrorHandler = require("./error").errorHandler; const index = (app, db) => { "use strict"; const sessionHandler = new SessionHandler(db); const profileHandler = new ProfileHandler(db); const benefitsHandler = new BenefitsHandler(db); const contributionsHandler = new ContributionsHandler(db); const allocationsHandler = new AllocationsHandler(db); const memosHandler = new MemosHandler(db); const researchHandler = new ResearchHandler(db); // Middleware to check if a user is logged in const isLoggedIn = sessionHandler.isLoggedInMiddleware; //Middleware to check if user has admin rights const isAdmin = sessionHandler.isAdminUserMiddleware; // The main page of the app app.get("/", sessionHandler.displayWelcomePage); // Login form app.get("/login", sessionHandler.displayLoginPage); app.post("/login", sessionHandler.handleLoginRequest); // Signup form app.get("/signup", sessionHandler.displaySignupPage); app.post("/signup", sessionHandler.handleSignup); // Logout page app.get("/logout", sessionHandler.displayLogoutPage); // The main page of the app app.get("/dashboard", isLoggedIn, sessionHandler.displayWelcomePage); // Profile page app.get("/profile", isLoggedIn, profileHandler.displayProfile); app.post("/profile", isLoggedIn, profileHandler.handleProfileUpdate); // Contributions Page app.get("/contributions", isLoggedIn, contributionsHandler.displayContributions); app.post("/contributions", isLoggedIn, contributionsHandler.handleContributionsUpdate); // Benefits Page app.get("/benefits", isLoggedIn, benefitsHandler.displayBenefits); app.post("/benefits", isLoggedIn, benefitsHandler.updateBenefits); /* Fix for A7 - checks user role to implement Function Level Access Control app.get("/benefits", isLoggedIn, isAdmin, benefitsHandler.displayBenefits); app.post("/benefits", isLoggedIn, isAdmin, benefitsHandler.updateBenefits); */ // Allocations Page app.get("/allocations/:userId", isLoggedIn, allocationsHandler.displayAllocations); // Memos Page app.get("/memos", isLoggedIn, memosHandler.displayMemos); app.post("/memos", isLoggedIn, memosHandler.addMemos); // Handle redirect for learning resources link app.get("/learn", isLoggedIn, (req, res) => { // Insecure way to handle redirects by taking redirect url from query string return res.redirect(req.query.url); }); // Handle redirect for learning resources link app.get("/tutorial", (req, res) => { return res.render("tutorial/a1", { environmentalScripts }); }); app.get("/tutorial/:page", (req, res) => { const { page } = req.params @@ -88,1 +89,8 @@ - return res.render(`tutorial/${page}`, { + const resolvedPath = path.resolve(page); + const expectedDir = path.resolve(__dirname, 'tutorial'); // TODO: Change this to your expected directory + if (!resolvedPath.startsWith(expectedDir)) { + throw new Error('Invalid page'); + } + return res.render(resolvedPath, { + environmentalScripts + }); environmentalScripts }); }); // Research Page app.get("/research", isLoggedIn, researchHandler.displayResearch); // Error handling middleware app.use(ErrorHandler); }; module.exports = index; Create Pull Request Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet

No Automatic Remediation (9)

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	Code Injection	CWE-94	error.js:10	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/error.js Lines 5 to 10 in d950a24 "use strict"; console.error(err.message); console.error(err.stack); res.status(500); res.render("error-template", { 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 97 in d950a24 app.use(ErrorHandler); NodeGoat_Demo/app/routes/error.js Line 3 in d950a24 const errorHandler = (err, req, res,next) => { NodeGoat_Demo/app/routes/error.js Line 11 in d950a24 error: err NodeGoat_Demo/app/routes/error.js Line 10 in d950a24 res.render("error-template", { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Code Injection Training ● Videos    ▪ Secure Code Warrior Code Injection Video ● Further Reading    ▪ OWASP Command Injection
High	Code Injection	CWE-94	profile.js:65	7	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/profile.js Lines 60 to 65 in d950a24 // Allow only numbers with a suffix of the letter #, for example: 'XXXXXX#' const testComplyWithRequirements = regexPattern.test(bankRouting); // if the regex test fails we do not allow saving if (testComplyWithRequirements !== true) { const firstNameSafeString = firstName return res.render("profile", { 7 Data Flow/s detected View Data Flow 1 NodeGoat_Demo/app/routes/index.js Line 50 in d950a24 app.post("/profile", isLoggedIn, profileHandler.handleProfileUpdate); NodeGoat_Demo/app/routes/profile.js Line 40 in d950a24 this.handleProfileUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/profile.js Line 45 in d950a24 ssn, NodeGoat_Demo/app/routes/profile.js Line 69 in d950a24 ssn, NodeGoat_Demo/app/routes/profile.js Line 65 in d950a24 return res.render("profile", { View Data Flow 2 NodeGoat_Demo/app/routes/index.js Line 50 in d950a24 app.post("/profile", isLoggedIn, profileHandler.handleProfileUpdate); NodeGoat_Demo/app/routes/profile.js Line 40 in d950a24 this.handleProfileUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/profile.js Line 44 in d950a24 lastName, NodeGoat_Demo/app/routes/profile.js Line 68 in d950a24 lastName, NodeGoat_Demo/app/routes/profile.js Line 65 in d950a24 return res.render("profile", { View Data Flow 3 NodeGoat_Demo/app/routes/index.js Line 50 in d950a24 app.post("/profile", isLoggedIn, profileHandler.handleProfileUpdate); NodeGoat_Demo/app/routes/profile.js Line 40 in d950a24 this.handleProfileUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/profile.js Line 46 in d950a24 dob, NodeGoat_Demo/app/routes/profile.js Line 70 in d950a24 dob, NodeGoat_Demo/app/routes/profile.js Line 65 in d950a24 return res.render("profile", { View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Code Injection Training ● Videos    ▪ Secure Code Warrior Code Injection Video ● Further Reading    ▪ OWASP Command Injection
High	Code Injection	CWE-94	contributions.js:34	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/contributions.js Lines 29 to 34 in d950a24 /*jslint evil: true */ // Insecure use of eval() to parse inputs const preTax = eval(req.body.preTax); const afterTax = eval(req.body.afterTax); const roth = eval(req.body.roth); 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 54 in d950a24 app.post("/contributions", isLoggedIn, contributionsHandler.handleContributionsUpdate); NodeGoat_Demo/app/routes/contributions.js Line 28 in d950a24 this.handleContributionsUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/contributions.js Line 34 in d950a24 const roth = eval(req.body.roth); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Code Injection Training ● Videos    ▪ Secure Code Warrior Code Injection Video ● Further Reading    ▪ OWASP Command Injection
High	Code Injection	CWE-94	contributions.js:33	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/contributions.js Lines 28 to 33 in d950a24 this.handleContributionsUpdate = (req, res, next) => { /*jslint evil: true */ // Insecure use of eval() to parse inputs const preTax = eval(req.body.preTax); const afterTax = eval(req.body.afterTax); 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 54 in d950a24 app.post("/contributions", isLoggedIn, contributionsHandler.handleContributionsUpdate); NodeGoat_Demo/app/routes/contributions.js Line 28 in d950a24 this.handleContributionsUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/contributions.js Line 33 in d950a24 const afterTax = eval(req.body.afterTax); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Code Injection Training ● Videos    ▪ Secure Code Warrior Code Injection Video ● Further Reading    ▪ OWASP Command Injection
High	Code Injection	CWE-94	contributions.js:32	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/contributions.js Lines 27 to 32 in d950a24 this.handleContributionsUpdate = (req, res, next) => { /*jslint evil: true */ // Insecure use of eval() to parse inputs const preTax = eval(req.body.preTax); 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 54 in d950a24 app.post("/contributions", isLoggedIn, contributionsHandler.handleContributionsUpdate); NodeGoat_Demo/app/routes/contributions.js Line 28 in d950a24 this.handleContributionsUpdate = (req, res, next) => { NodeGoat_Demo/app/routes/contributions.js Line 32 in d950a24 const preTax = eval(req.body.preTax); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Code Injection Training ● Videos    ▪ Secure Code Warrior Code Injection Video ● Further Reading    ▪ OWASP Command Injection
High	NoSQL Injection	CWE-943	user-dao.js:91	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/data/user-dao.js Lines 86 to 91 in d950a24 noSuchUserError.noSuchUser = true; callback(noSuchUserError, null); } } usersCol.findOne({ 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 36 in d950a24 app.post("/login", sessionHandler.handleLoginRequest); NodeGoat_Demo/app/routes/session.js Line 51 in d950a24 this.handleLoginRequest = (req, res, next) => { NodeGoat_Demo/app/routes/session.js Line 53 in d950a24 userName, NodeGoat_Demo/app/routes/session.js Line 56 in d950a24 userDAO.validateLogin(userName, password, (err, user) => { NodeGoat_Demo/app/data/user-dao.js Line 57 in d950a24 this.validateLogin = (userName, password, callback) => { NodeGoat_Demo/app/data/user-dao.js Line 92 in d950a24 userName: userName NodeGoat_Demo/app/data/user-dao.js Line 91 in d950a24 usersCol.findOne({ Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior NoSQL Injection Training ● Videos    ▪ Secure Code Warrior NoSQL Injection Video
High	NoSQL Injection	CWE-943	memos-dao.js:23	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/data/memos-dao.js Lines 18 to 23 in d950a24 const memos = { memo, timestamp: new Date() }; memosCol.insert(memos, (err, result) => !err ? callback(null, result) : callback(err, null)); 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 69 in d950a24 app.post("/memos", isLoggedIn, memosHandler.addMemos); NodeGoat_Demo/app/routes/memos.js Line 11 in d950a24 this.addMemos = (req, res, next) => { NodeGoat_Demo/app/routes/memos.js Line 13 in d950a24 memosDAO.insert(req.body.memo, (err, docs) => { NodeGoat_Demo/app/data/memos-dao.js Line 15 in d950a24 this.insert = (memo, callback) => { NodeGoat_Demo/app/data/memos-dao.js Line 19 in d950a24 memo, NodeGoat_Demo/app/data/memos-dao.js Line 23 in d950a24 memosCol.insert(memos, (err, result) => !err ? callback(null, result) : callback(err, null)); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior NoSQL Injection Training ● Videos    ▪ Secure Code Warrior NoSQL Injection Video
High	Server Side Request Forgery	CWE-918	research.js:16	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/routes/research.js Lines 11 to 16 in d950a24 this.displayResearch = (req, res) => { if (req.query.symbol) { const url = req.query.url + req.query.symbol; return needle.get(url, (error, newResponse, body) => { 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 94 in d950a24 app.get("/research", isLoggedIn, researchHandler.displayResearch); NodeGoat_Demo/app/routes/research.js Line 12 in d950a24 this.displayResearch = (req, res) => { NodeGoat_Demo/app/routes/research.js Line 15 in d950a24 const url = req.query.url + req.query.symbol; NodeGoat_Demo/app/routes/research.js Line 16 in d950a24 return needle.get(url, (error, newResponse, body) => { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Server Side Request Forgery Training ● Videos    ▪ Secure Code Warrior Server Side Request Forgery Video
High	NoSQL Injection	CWE-943	user-dao.js:104	1	2024-05-16 06:53am
Vulnerable Code NodeGoat_Demo/app/data/user-dao.js Lines 99 to 104 in d950a24 _id: parseInt(userId) }, callback); }; this.getUserByUserName = (userName, callback) => { usersCol.findOne({ 1 Data Flow/s detected NodeGoat_Demo/app/routes/index.js Line 40 in d950a24 app.post("/signup", sessionHandler.handleSignup); NodeGoat_Demo/app/routes/session.js Line 183 in d950a24 this.handleSignup = (req, res, next) => { NodeGoat_Demo/app/routes/session.js Line 187 in d950a24 userName, NodeGoat_Demo/app/routes/session.js Line 200 in d950a24 if (validateSignup(userName, firstName, lastName, password, verify, email, errors)) { NodeGoat_Demo/app/routes/session.js Line 132 in d950a24 const validateSignup = (userName, firstName, lastName, password, verify, email, errors) => { NodeGoat_Demo/app/routes/session.js Line 200 in d950a24 if (validateSignup(userName, firstName, lastName, password, verify, email, errors)) { NodeGoat_Demo/app/routes/session.js Line 202 in d950a24 userDAO.getUserByUserName(userName, (err, user) => { NodeGoat_Demo/app/data/user-dao.js Line 103 in d950a24 this.getUserByUserName = (userName, callback) => { NodeGoat_Demo/app/data/user-dao.js Line 105 in d950a24 userName: userName NodeGoat_Demo/app/data/user-dao.js Line 104 in d950a24 usersCol.findOne({ Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior NoSQL Injection Training ● Videos    ▪ Secure Code Warrior NoSQL Injection Video

Findings Overview

Severity	Vulnerability Type	CWE	Language	Count
High	Path/Directory Traversal	CWE-22	JavaScript / TypeScript*	1
High	Code Injection	CWE-94	JavaScript / TypeScript*	5
High	Server Side Request Forgery	CWE-918	JavaScript / TypeScript*	1
High	NoSQL Injection	CWE-943	JavaScript / TypeScript*	4
Low	Sensitive Cookie Without Secure	CWE-614	JavaScript / TypeScript*	1