Is CVE-2019-5413 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-5413 being exploited in the wild.

How severe is CVE-2019-5413?

Low severity, with a CVSS score of 3, published 25 March 2019.

Which products and versions are affected?

morgan (npm) SEMVER:introduced=0,fixed=1.9.1.

Is there a fix for CVE-2019-5413?

Yes. morgan (npm): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-5413 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-5413?

Check whether you run morgan (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-5413: Morgan code injection in logging filter

CVE-2019-5413 · Severity: low · CVSS 3 · Published 2019-03-25

Morgan is a popular logging middleware for Node.js applications used to record HTTP requests and responses. A code injection vulnerability in versions before 1.9.1 allows attackers to execute arbitrary code when user-supplied data is logged, particularly if combined with prototype pollution attacks, potentially compromising the entire application and server.

Technologies: morgan (npm). Vendors: npm.

Quick answers

Is CVE-2019-5413 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-5413 being exploited in the wild.
How severe is CVE-2019-5413?: Low severity, with a CVSS score of 3, published 25 March 2019.
Which products and versions are affected?: morgan (npm) SEMVER:introduced=0,fixed=1.9.1.
Is there a fix for CVE-2019-5413?: Yes. morgan (npm): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-5413 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-5413?: Check whether you run morgan (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

morgan (npm): upgrade to 1.9.1 or later
```
npm install morgan@1.9.1
```

Technical details

Morgan versions before 1.9.1 contain a code injection vulnerability (CWE-94) in the logging filter mechanism. The vulnerability occurs when user-controlled input is passed to the logging filter without proper sanitization, allowing attackers to inject arbitrary code. The attack can be weaponized further when combined with prototype pollution techniques. The vulnerability is network-accessible and requires no authentication or user interaction, making it exploitable by unauthenticated remote attackers. Updating to version 1.9.1 or later resolves the issue.

Affected products

Morgan morgan before 1.9.1

Identifiers

CVE-2019-5413
GHSA-gwg9-rgvj-4h5j

Timeline

2019-03-25: disclosed
2019-03-25: patched: Fixed in version 1.9.1

References

https://hackerone.com/reports/390881

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.