Executive brief
node-sass is a popular Node.js library that compiles Sass stylesheets to CSS and automatically downloads precompiled binaries. This vulnerability disables certificate validation when downloading these binaries, allowing an attacker on the network to intercept the download and deliver malicious code that would be executed during installation. This could compromise any system using an affected version of node-sass.
Technical details
node-sass versions 2.0.0 through 6.0.1 disable SSL/TLS certificate validation (CWE-295) when downloading precompiled binaries from remote servers, even when the user has not specified an alternative download path. This occurs at the network layer during the npm install phase. An attacker performing a man-in-the-middle attack can intercept HTTPS connections and serve malicious binaries, which would then be extracted and executed during the package installation. The vulnerability was fixed in version 7.0.0, and patches were backported to earlier release branches.
Affected products
- Sass node-sass 2.0.0 to 6.0.1
Timeline
- 2021-01-11: disclosed: Published to NVD
- 2022-02-09: other: GitHub advisory published (GHSA-r8f7-9pfq-mjmv)
- 7.0.0: patched: Fixed in version 7.0.0