Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 25 May 2022.

Which products and versions are affected?

faisalman ua-parser-js 0.7.29, 0.8.0, 1.0.0.

Is there a fix for This vulnerability?

A patch was published on 2021-10-22: Clean versions 0.7.30, 0.8.1, and 1.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

faisalman ua-parser-js embedded malware and backdoor

Severity: low · CVSS 3.1 · Published 2022-05-25

The popular JavaScript library ua-parser-js, used to identify browser and device information, was compromised by an unauthorized party who injected malicious code into several versions. This malware includes a cryptocurrency miner and a backdoor that could allow attackers to steal sensitive data or take full control of affected systems. Organizations using the impacted versions should consider their systems fully compromised and rotate all credentials and secrets.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 25 May 2022.
Which products and versions are affected?: faisalman ua-parser-js 0.7.29, 0.8.0, 1.0.0.
Is there a fix for This vulnerability?: A patch was published on 2021-10-22: Clean versions 0.7.30, 0.8.1, and 1.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a supply chain attack involving the injection of malicious functionality (CWE-912) into the ua-parser-js npm package. Versions 0.7.29, 0.8.0, and 1.0.0 were modified by an attacker to include a cryptocurrency miner and a backdoor capable of executing arbitrary commands. The attack vector is network-based, triggered when a user or automated system installs or runs the compromised package versions. Successful exploitation results in full system compromise, including the potential theft of environment variables, secrets, and persistent remote access. Users must upgrade to versions 0.7.30, 0.8.1, or 1.0.1 and perform a full incident response on affected machines.

Affected products

faisalman ua-parser-js 0.7.29, 0.8.0, 1.0.0

Timeline

2021-10-22: disclosed: Initial discovery of compromised packages
2021-10-22: patched: Clean versions 0.7.30, 0.8.1, and 1.0.1 released
2022-05-25: advisory: Initial publication of this advisory record

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.