CVE-2015-8857: UglifyJS incorrect boolean expression rewriting

CVE-2015-8857 · Severity: critical · CVSS 9.8 · Published 2017-01-23

UglifyJS is a widely used tool for compressing and optimizing JavaScript code to make websites load faster. A flaw in how it handles certain logical comparisons allows it to incorrectly rewrite code during the compression process, changing the program's actual behavior. This could allow a malicious actor to submit code that appears safe during manual review but becomes a functional backdoor or security bypass once processed by the tool.

Technologies: uglify-js (npm), Uglifyjs Project Uglifyjs. Vendors: npm, RubyGems, Uglifyjs Project.

Quick answers

Is CVE-2015-8857 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2015-8857 being exploited in the wild.
How severe is CVE-2015-8857?
Critical severity, with a CVSS score of 9.8, published 23 January 2017.
Which products and versions are affected?
uglify-js (npm) SEMVER:introduced=0,fixed=2.4.24; uglifier (RubyGems) ECOSYSTEM:introduced=0,fixed=2.7.2.
Is there a fix for CVE-2015-8857?
Yes. uglify-js (npm): upgrade to 2.4.24 or later; uglifier (RubyGems): upgrade to 2.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8857 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2015-8857?
Check whether you run uglify-js (npm), uglifier (RubyGems) or Uglifyjs Project Uglifyjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uglify-js (npm): upgrade to 2.4.24 or later
    npm install uglify-js@2.4.24
  • uglifier (RubyGems): upgrade to 2.7.2 or later
    bundle update uglifier

Technical details

UglifyJS versions prior to 2.4.24 contain a logic error in the compressor's optimization of boolean expressions. The tool incorrectly applies De Morgan's Law to rewrite expressions (e.g., converting '!a && !b' to '!(a || b)') without properly accounting for non-boolean return values. Because JavaScript logical operators can return the value of the operands themselves rather than a strict boolean, this transformation can change the execution flow of the application. An attacker can exploit this by crafting code that passes security audits in its original form but executes malicious logic or bypasses authentication checks after being minified. This affects both the Node.js 'uglify-js' package and the Ruby 'uglifier' gem which wraps it.

Affected products

  • mishoo uglify-js < 2.4.24
  • lautis uglifier < 2.7.2

Identifiers

  • CVE-2015-8857
  • GHSA-34r7-q49f-h37c

Timeline

  • 2015-07-21: other: Vulnerability identified and reported in Ruby advisory database
  • 2015-08-24: disclosed: Public blog post detailing the 'backdooring' technique published
  • 2017-01-23: advisory: NVD published CVE-2015-8857
  • 2017-10-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.