search

SharonKoch / skf-labs

Repo for all the OWASP-SKF Docker lab examples
Apache License 2.0
0 stars 1 forks source link

ejs-3.1.6.tgz: 2 vulnerabilities (highest severity is: 9.8) #38

Open mend-for-github-com[bot] opened 11 months ago

mend-for-github-com[bot] commented 11 months ago
Vulnerable Library - ejs-3.1.6.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.6.tgz

Path to dependency file: /nodeJs/XSS-DOM/package.json

Path to vulnerable library: /nodeJs/XSS-DOM/package.json,/nodeJs/Formula-Injection/package.json,/nodeJs/IDOR/package.json,/nodeJs/XSS-DOM-2/package.json,/nodeJs/LFI-3/package.json,/nodeJs/Untrusted-sources-js/package.json,/nodeJs/LFI-2/package.json,/nodeJs/XSS-attribute/package.json,/nodeJs/XXE/package.json,/nodeJs/Auth-Bypass-simple/package.json,/nodeJs/ParameterBinding/package.json,/nodeJs/CSP/package.json,/nodeJs/SQLI/package.json,/nodeJs/CSRF-weak/package.json,/nodeJs/Client-side-restriction-bypass/package.json,/nodeJs/SSRF/package.json,/nodeJs/Info-leakage-comments/package.json,/nodeJs/DOS-regex/package.json,/nodeJs/Graphql-Introspection/package.json,/nodeJs/RaceCondition/package.json,/nodeJs/Prototype-Pollution/package.json,/nodeJs/CMD-Blind/package.json,/nodeJs/XSS-url/package.json,/nodeJs/Url-redirection/package.json,/nodeJs/RaceCondition-file-write/package.json,/nodeJs/Url-redirection-harder/package.json,/nodeJs/Ldap-Injection/package.json,/nodeJs/SessionPuzzle/package.json,/nodeJs/CSTI/package.json,/nodeJs/JWT-secret/package.json,/nodeJs/Graphql-Mutations/package.json,/nodeJs/Ratelimiting/package.json,/nodeJs/Url-redirection-harder2/package.json,/nodeJs/SQLI-blind/package.json,/nodeJs/File-upload/package.json,/nodeJs/RFI/package.json,/nodeJs/JWT-null/package.json,/nodeJs/Auth-Bypass-3/package.json,/nodeJs/LFI/package.json,/nodeJs/Info-leakage-metadata/package.json,/nodeJs/CMD4/package.json,/nodeJs/CSSI/package.json,/nodeJs/Auth-Bypass/package.json,/nodeJs/RTLO/package.json,/nodeJs/CSRF-samesite/package.json,/nodeJs/CMD2/package.json,/nodeJs/CMD/package.json,/nodeJs/Client-side-restriction-bypass-2/package.json,/nodeJs/Http-response-splitting/package.json,/nodeJs/CMD3/package.json,/nodeJs/Graphql-Injection/package.json,/nodeJs/XSS/package.json,/nodeJs/Auth-Bypass-1/package.json,/nodeJs/Auth-Bypass-2/package.json,/nodeJs/Credentials-guessing-1/package.json,/nodeJs/Credentials-guessing-2/package.json,/nodeJs/Ldap-Injection-harder/package.json,/nodeJs/SQLI-like/package.json,/nodeJs/Session-hijacking-xss/package.json,/nodeJs/CORS/package.json,/nodeJs/Content-type/package.json

Found in HEAD commit: dbff3320673205dea2e0a4c513d54497ca905aab

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (ejs version) Remediation Possible**
CVE-2022-29078 Critical 9.8 ejs-3.1.6.tgz Direct 3.1.7 ✅
CVE-2024-33883 High 8.8 ejs-3.1.6.tgz Direct ejs - 3.1.10 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-29078 ### Vulnerable Library - ejs-3.1.6.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.6.tgz

Path to dependency file: /nodeJs/XSS-DOM/package.json

Path to vulnerable library: /nodeJs/XSS-DOM/package.json,/nodeJs/Formula-Injection/package.json,/nodeJs/IDOR/package.json,/nodeJs/XSS-DOM-2/package.json,/nodeJs/LFI-3/package.json,/nodeJs/Untrusted-sources-js/package.json,/nodeJs/LFI-2/package.json,/nodeJs/XSS-attribute/package.json,/nodeJs/XXE/package.json,/nodeJs/Auth-Bypass-simple/package.json,/nodeJs/ParameterBinding/package.json,/nodeJs/CSP/package.json,/nodeJs/SQLI/package.json,/nodeJs/CSRF-weak/package.json,/nodeJs/Client-side-restriction-bypass/package.json,/nodeJs/SSRF/package.json,/nodeJs/Info-leakage-comments/package.json,/nodeJs/DOS-regex/package.json,/nodeJs/Graphql-Introspection/package.json,/nodeJs/RaceCondition/package.json,/nodeJs/Prototype-Pollution/package.json,/nodeJs/CMD-Blind/package.json,/nodeJs/XSS-url/package.json,/nodeJs/Url-redirection/package.json,/nodeJs/RaceCondition-file-write/package.json,/nodeJs/Url-redirection-harder/package.json,/nodeJs/Ldap-Injection/package.json,/nodeJs/SessionPuzzle/package.json,/nodeJs/CSTI/package.json,/nodeJs/JWT-secret/package.json,/nodeJs/Graphql-Mutations/package.json,/nodeJs/Ratelimiting/package.json,/nodeJs/Url-redirection-harder2/package.json,/nodeJs/SQLI-blind/package.json,/nodeJs/File-upload/package.json,/nodeJs/RFI/package.json,/nodeJs/JWT-null/package.json,/nodeJs/Auth-Bypass-3/package.json,/nodeJs/LFI/package.json,/nodeJs/Info-leakage-metadata/package.json,/nodeJs/CMD4/package.json,/nodeJs/CSSI/package.json,/nodeJs/Auth-Bypass/package.json,/nodeJs/RTLO/package.json,/nodeJs/CSRF-samesite/package.json,/nodeJs/CMD2/package.json,/nodeJs/CMD/package.json,/nodeJs/Client-side-restriction-bypass-2/package.json,/nodeJs/Http-response-splitting/package.json,/nodeJs/CMD3/package.json,/nodeJs/Graphql-Injection/package.json,/nodeJs/XSS/package.json,/nodeJs/Auth-Bypass-1/package.json,/nodeJs/Auth-Bypass-2/package.json,/nodeJs/Credentials-guessing-1/package.json,/nodeJs/Credentials-guessing-2/package.json,/nodeJs/Ldap-Injection-harder/package.json,/nodeJs/SQLI-like/package.json,/nodeJs/Session-hijacking-xss/package.json,/nodeJs/CORS/package.json,/nodeJs/Content-type/package.json

Dependency Hierarchy: - :x: **ejs-3.1.6.tgz** (Vulnerable Library)

Found in HEAD commit: dbff3320673205dea2e0a4c513d54497ca905aab

Found in base branch: master

### Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution: 3.1.7

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-33883 ### Vulnerable Library - ejs-3.1.6.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.6.tgz

Path to dependency file: /nodeJs/XSS-DOM/package.json

Path to vulnerable library: /nodeJs/XSS-DOM/package.json,/nodeJs/Formula-Injection/package.json,/nodeJs/IDOR/package.json,/nodeJs/XSS-DOM-2/package.json,/nodeJs/LFI-3/package.json,/nodeJs/Untrusted-sources-js/package.json,/nodeJs/LFI-2/package.json,/nodeJs/XSS-attribute/package.json,/nodeJs/XXE/package.json,/nodeJs/Auth-Bypass-simple/package.json,/nodeJs/ParameterBinding/package.json,/nodeJs/CSP/package.json,/nodeJs/SQLI/package.json,/nodeJs/CSRF-weak/package.json,/nodeJs/Client-side-restriction-bypass/package.json,/nodeJs/SSRF/package.json,/nodeJs/Info-leakage-comments/package.json,/nodeJs/DOS-regex/package.json,/nodeJs/Graphql-Introspection/package.json,/nodeJs/RaceCondition/package.json,/nodeJs/Prototype-Pollution/package.json,/nodeJs/CMD-Blind/package.json,/nodeJs/XSS-url/package.json,/nodeJs/Url-redirection/package.json,/nodeJs/RaceCondition-file-write/package.json,/nodeJs/Url-redirection-harder/package.json,/nodeJs/Ldap-Injection/package.json,/nodeJs/SessionPuzzle/package.json,/nodeJs/CSTI/package.json,/nodeJs/JWT-secret/package.json,/nodeJs/Graphql-Mutations/package.json,/nodeJs/Ratelimiting/package.json,/nodeJs/Url-redirection-harder2/package.json,/nodeJs/SQLI-blind/package.json,/nodeJs/File-upload/package.json,/nodeJs/RFI/package.json,/nodeJs/JWT-null/package.json,/nodeJs/Auth-Bypass-3/package.json,/nodeJs/LFI/package.json,/nodeJs/Info-leakage-metadata/package.json,/nodeJs/CMD4/package.json,/nodeJs/CSSI/package.json,/nodeJs/Auth-Bypass/package.json,/nodeJs/RTLO/package.json,/nodeJs/CSRF-samesite/package.json,/nodeJs/CMD2/package.json,/nodeJs/CMD/package.json,/nodeJs/Client-side-restriction-bypass-2/package.json,/nodeJs/Http-response-splitting/package.json,/nodeJs/CMD3/package.json,/nodeJs/Graphql-Injection/package.json,/nodeJs/XSS/package.json,/nodeJs/Auth-Bypass-1/package.json,/nodeJs/Auth-Bypass-2/package.json,/nodeJs/Credentials-guessing-1/package.json,/nodeJs/Credentials-guessing-2/package.json,/nodeJs/Ldap-Injection-harder/package.json,/nodeJs/SQLI-like/package.json,/nodeJs/Session-hijacking-xss/package.json,/nodeJs/CORS/package.json,/nodeJs/Content-type/package.json

Dependency Hierarchy: - :x: **ejs-3.1.6.tgz** (Vulnerable Library)

Found in HEAD commit: dbff3320673205dea2e0a4c513d54497ca905aab

Found in base branch: master

### Vulnerability Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Publish Date: 2024-04-28

URL: CVE-2024-33883

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883

Release Date: 2024-04-28

Fix Resolution: ejs - 3.1.10

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.