Executive brief
Seneca, a microservices framework for Node.js, contains a vulnerability where it may leak sensitive system information during a process crash. When the application fails, it automatically prints all environment variables to the error logs, which often include sensitive data like database passwords, API keys, and secret tokens. This information could be accessed by unauthorized individuals who have access to log-monitoring systems or error outputs.
Technical details
Seneca versions prior to 3.9.0 are affected by CWE-209 (Generation of Error Message Containing Sensitive Information). The vulnerability occurs during process termination or crashes, where the framework's error handling logic outputs the entire 'process.env' object to the standard error stream. This behavior can lead to the exposure of sensitive credentials, such as AWS keys or database strings, especially in environments where logs are aggregated or monitored by third-party services. An attacker does not necessarily need direct access to the application to exploit this if they can view logs or trigger a crash. The issue is resolved in version 3.9.0.
Affected products
- senecajs seneca < 3.9.0
Timeline
- 2019-09-09: advisory: NVD published CVE-2019-5483
- 2019-09-11: disclosed: GitHub Advisory GHSA-2xwv-3cc9-fp7c published
- 2019-09-03: patched: Version 3.9.0 released to address the issue