Junglewise Threat Intelligence

CVE-2020-7677: thenify before 3.3.1 made use of unsafe calls to `eval`.

CVE-2020-7677 · Severity: critical · CVSS 9.8 · Published 2022-07-18

Vendors: Maven, npm, Debian.

Executive brief

thenify is a software library used by developers to convert older callback-style code into modern JavaScript promises. A security flaw in versions before 3.3.1 allows attackers to execute malicious code on the server by providing specially crafted function names. This could lead to a full system takeover, data theft, or service disruption.

Technical details

The thenify library is vulnerable to arbitrary code execution (CWE-78/CWE-94) because it uses the `eval()` function to dynamically create functions. Specifically, the `name` argument passed to the library is not sanitized before being concatenated into a string that is executed via `eval()`. An attacker who can control the function name passed to `thenify()` can inject and execute arbitrary JavaScript code in the context of the application. This is a remote, unauthenticated attack vector requiring no user interaction. The vulnerability is fixed in version 3.3.1 by removing the use of `eval()`.

Affected products

  • thenables thenify < 3.3.1
  • Debian node-thenify 3.3.0-1+deb10u1

Timeline

  • 2020-06-17: disclosed: Issue reported on GitHub repository
  • 2020-06-17: patched: Fix committed to repository
  • 2022-07-18: advisory: GitHub Security Advisory published
  • 2022-07-25: advisory: NVD published CVE-2020-7677

References