Executive brief
summit is a data synchronization library that includes support for the PouchDB database driver. An attacker can inject arbitrary code by providing a malicious collection name, allowing complete compromise of the application, including reading sensitive data, modifying information, or disrupting service availability. The package author has abandoned the PouchDB driver feature, and no patch is available.
Technical details
The vulnerability is a code injection flaw (CWE-94) in lib/drivers/search/pouch.js where user-supplied collection names are directly concatenated into JavaScript code and passed to eval() without sanitization. An attacker can craft a malicious collection name string containing JavaScript payloads that will be executed in the context of the application. The attack requires no authentication or user interaction—the attacker simply needs to control the collection name parameter when using the PouchDB driver. Successful exploitation grants arbitrary code execution with the privileges of the application process. No patch is available; the recommended mitigation is to avoid using the PouchDB driver entirely.
Affected products
- summit summit 0.1.0 through 0.1.22
Timeline
- 2016-04-08: disclosed: Issue opened on GitHub
- 2018-06-04: advisory: CVE-2017-16020 published on NVD
- 2020-01-16: other: Repository archived by owner; no fix provided
- 2020-09-01: other: GHSA-cwcp-6c48-fm7m published