Junglewise Threat Intelligence

CVE-2015-8857: UglifyJS incorrect boolean expression rewriting

CVE-2015-8857 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Technologies: uglify-js (npm), Uglifyjs Project Uglifyjs. Vendors: RubyGems, npm, Uglifyjs Project.

Executive brief

UglifyJS is a widely used tool for compressing and optimizing JavaScript code to make websites load faster. A flaw in how it handles certain logical comparisons allows it to incorrectly rewrite code during the compression process, changing the program's actual behavior. This could allow a malicious actor to submit code that appears safe during manual review but becomes a functional backdoor or security bypass once processed by the tool.

Technical details

UglifyJS versions prior to 2.4.24 contain a logic error in the compressor's optimization of boolean expressions. The tool incorrectly applies De Morgan's Law to rewrite expressions (e.g., converting '!a && !b' to '!(a || b)') without properly accounting for non-boolean return values. Because JavaScript logical operators can return the value of the operands themselves rather than a strict boolean, this transformation can change the execution flow of the application. An attacker can exploit this by crafting code that passes security audits in its original form but executes malicious logic or bypasses authentication checks after being minified. This affects both the Node.js 'uglify-js' package and the Ruby 'uglifier' gem which wraps it.

Affected products

  • mishoo uglify-js < 2.4.24
  • lautis uglifier < 2.7.2

Timeline

  • 2015-07-21: other: Vulnerability identified and reported in Ruby advisory database
  • 2015-08-24: disclosed: Public blog post detailing the 'backdooring' technique published
  • 2017-01-23: advisory: NVD published CVE-2015-8857
  • 2017-10-24: advisory: GitHub Advisory published

References

Related threats