Executive brief
The syntax-error npm package is a utility used by browserify to detect syntax errors in JavaScript source code. Versions prior to 1.1.1 contain a code injection vulnerability that could allow malicious JavaScript files to execute arbitrary code during the browserification process, potentially compromising the build pipeline and any applications built with affected versions.
Technical details
The syntax-error package uses the Function() constructor to validate JavaScript code for syntax errors. The vulnerability (CWE-94: Improper Control of Generation of Code) arises because the Function() constructor can execute arbitrary code passed to it. Attackers can craft malicious source files that, when passed through the syntax-error checker, execute injected code in the context of the build process. The fix replaces Function() with eval() wrapped in an early throw statement, preventing successful code execution. The vulnerability affects all versions before 1.1.1 and was patched in version 1.1.1 or later. No authentication is required; exploitation occurs during routine build operations when processing untrusted or compromised source files.
Affected products
- browserify syntax-error < 1.1.1
Timeline
- 2017-10-24: disclosed
- 2014: patched: Fix implemented via commit 9aa4e66, replacing Function() with eval() approach
References
- https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
- https://github.com/substack/node-browserify/blob/master/changelog.markdown
- https://github.com/substack/node-syntax-error
- https://www.npmjs.com/advisories/37