Executive brief
access-policy is a Node.js package used to encode and decode policy configuration files for web applications. A vulnerability allows attackers to execute arbitrary code on systems using this package by injecting malicious input into the template function, which is unsafely evaluated. An attacker can gain complete control over the affected system without authentication or user interaction.
Technical details
The vulnerability is an improper input validation flaw (CWE-94: Improper Control of Generation of Code) in the access-policy package through version 3.1.0. User-supplied input passed to the template function is directly executed via the eval() function, enabling arbitrary code execution. The attack requires only network access to a system using the vulnerable package and no authentication or privileges; the vulnerable code path is invoked during the encode() operation. An attacker can execute arbitrary JavaScript code with the same privileges as the application process. No patched version is currently available for this package.
Affected products
- npm access-policy through 3.1.0
Timeline
- 2020-06-05: disclosed
- 2021-05-17: advisory
- 2020-06-10: other: NVD published