Executive brief
The accesslog package is a Node.js logging middleware used to record HTTP request details to files or streams. An attacker who can control the format option during package initialization can inject and execute arbitrary JavaScript code on the server, potentially compromising the entire application and its data.
Technical details
The vulnerability is an arbitrary code injection flaw (CWE-94) caused by unsafe use of the Function constructor without input sanitization on the format parameter. An attacker can pass malicious format strings to the exported constructor function, which are evaluated as code via the Function constructor, allowing execution of arbitrary JavaScript. The attack requires the ability to control the format option when instantiating the accesslog middleware, making it a configuration-level injection vector. All versions up to 0.0.2 are affected. A fix requires input validation or avoiding dynamic code generation.
Affected products
- Carlos Rodriguez accesslog 0.0.2 and earlier
Timeline
- 2022-03-18: disclosed
- 2022-03-17: other: NVD published CVE-2022-25760