search

jashkenas / underscore

JavaScript's utility _ belt
https://underscorejs.org
MIT License
27.3k stars 5.53k forks source link

Security issue - underscore-min.js Lodash Script? #2911

Closed AlAyoub closed 3 years ago

AlAyoub commented 3 years ago

Hi,

My scanner is picking up a vulnerability from underscore It appears the issue is that underscore is using a lodash script in underscore-min.js. Is that correct? Can anyone confirm?

There was a PR that fixed the issue in 4.17.21. https://github.com/lodash/lodash/pull/5085/files

jgonggrijp commented 3 years ago

Hi @AlAyoub, thanks for reaching out. Underscore does not depend on Lodash; to the contrary, Lodash is a fork of Underscore. You are probably dealing with a file named underscore-min.js that actually contains an old version of Lodash.

I'll close this ticket now, but please feel free to continue discussion if you feel the need.

jgonggrijp commented 3 years ago

@AlAyoub thanks for getting back here.

This appears to be a security vulnerability that Lodash inherited from Underscore, and for some reason the vulnerability was only reported to Lodash and not to Underscore. That's what you get with forks.

Anyway, it appears the issue does indeed also apply to Underscore. I'll fix this with high priority.

jgonggrijp commented 3 years ago

Hang on. _.template allows arbitrary code injection anyway, since that's how the template function is implemented. The first argument (the template itself) is supposed to contain JavaScript code. Validating the second argument is not going to prevent code injection, since whoever submits the second argument is also submitting the first argument (the template and the variable name have to be coordinated). I'll investigate further.

jgonggrijp commented 3 years ago

@AlAyoub I was able to confirm that the vulnerability does not, in fact, apply to Underscore. See #2912.

Underscore will pass the variable option to the Function constructor as an argument name. This ensures that the name is validated. Lodash doesn't do this, so they needed a fix.

Could you tell me the name of your scanner, preferably with a link to their website, so I can contact the maintainers about this false alarm?

jgonggrijp commented 3 years ago

@AlAyoub thank you for bringing this to our attention. Had it been a true alarm, we wouldn't have known about it without you (or at least not as soon).

AlAyoub commented 3 years ago

@jgonggrijp - confirmed that this is a false alarm. Thank you again for acting fast, I appreciate it!

jgonggrijp commented 3 years ago

Thanks for wrapping up, @AlAyoub !

jgonggrijp commented 3 years ago

@AlAyoub While the Lodash CVE doesn't apply to Underscore, it turns out that there was in fact a security leak in _.template. I just published versions 1.12.1 and 1.13.0-2, which fix it. See also #2915.