Executive brief
Morgan is a popular logging middleware for Node.js applications used to record HTTP requests and responses. A code injection vulnerability in versions before 1.9.1 allows attackers to execute arbitrary code when user-supplied data is logged, particularly if combined with prototype pollution attacks, potentially compromising the entire application and server.
Technical details
Morgan versions before 1.9.1 contain a code injection vulnerability (CWE-94) in the logging filter mechanism. The vulnerability occurs when user-controlled input is passed to the logging filter without proper sanitization, allowing attackers to inject arbitrary code. The attack can be weaponized further when combined with prototype pollution techniques. The vulnerability is network-accessible and requires no authentication or user interaction, making it exploitable by unauthenticated remote attackers. Updating to version 1.9.1 or later resolves the issue.
Affected products
- Morgan morgan before 1.9.1
Timeline
- 2019-03-25: disclosed
- 2019-03-25: patched: Fixed in version 1.9.1