Executive brief
morgan-json is a Node.js library that formats HTTP request logs as JSON. The library fails to sanitize user input before passing it to the JavaScript Function constructor, allowing attackers to execute arbitrary code on any server using this package. An attacker can craft malicious HTTP requests that inject code executed by the server.
Technical details
This is a code injection vulnerability (CWE-94) in the morgan-json library. The vulnerable code passes unsanitized input directly to the JavaScript Function constructor when processing HTTP request log format strings or objects. An attacker can send specially crafted HTTP requests containing malicious code in headers, query parameters, or URL components that are incorporated into the log format. Since no authentication or special preconditions are required, any network-accessible server using morgan-json is vulnerable. Successful exploitation allows unauthenticated remote code execution with the privileges of the Node.js process. The affected versions include all releases up to and including 1.1.0.
Affected products
- indexzero morgan-json all versions through 1.1.0
Timeline
- 2022-08-29: disclosed
- 2022-09-16: other: GitHub reviewed and confirmed critical