CVE-2022-25760

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6	Broken Link
https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accesslog_project:accesslog:*:*:*:*:*:*:*:*

History

23 Mar 2022, 18:40

Type	Values Removed	Values Added
References	~~(MISC) https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099 -~~	(MISC) https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099 - Exploit, Third Party Advisory
References	~~(MISC) https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6 -~~	(MISC) https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6 - Broken Link
CWE		CWE-94
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 10.0 v3 : 9.8
CPE		cpe:2.3:a:accesslog_project:accesslog::::::::

17 Mar 2022, 12:50

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-17 12:15

Updated : 2024-02-04 22:29

NVD link : CVE-2022-25760

Mitre link : CVE-2022-25760

CVE.ORG link : CVE-2022-25760

JSON object : View

Products Affected

accesslog_project

accesslog

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2022-25760", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.6}]}, "published": "2022-03-17T12:15:08.293", "references": [{"url": "https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6", "tags": ["Broken Link"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on."}, {"lang": "es", "value": "Todas las versiones del paquete accesslog son vulnerables a una Inyecci\u00f3n de C\u00f3digo Arbitrario debido al uso del constructor Function sin un saneo de entrada. Si la entrada del usuario (controlada por el atacante) le es dada la opci\u00f3n de formato de la funci\u00f3n constructora exportada del paquete, es posible que un atacante ejecute c\u00f3digo JavaScript arbitrario en el host en el que est\u00e1 siendo ejecutado este paquete"}], "lastModified": "2022-03-23T18:40:44.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accesslog_project:accesslog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A36E23A9-8378-4497-8D7D-5E3B257F492D"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}