Executive brief
concat-with-sourcemaps is a utility used by developers to combine multiple files while maintaining their original source references. A vulnerability exists where the tool may inadvertently expose fragments of sensitive memory from the server or developer machine. This occurs when the tool is instructed to use a number as a file separator, leading it to read internal system memory instead of a text string.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) caused by the use of the deprecated `new Buffer(number)` constructor in Node.js. In versions of `concat-with-sourcemaps` prior to 1.0.6, if a number is passed as the `separator` argument to the `Concat` constructor, Node.js allocates a new buffer of that size without initializing it with zeroes. This buffer contains whatever data was previously stored in that memory space. An attacker who can influence the separator argument can cause the application to include uninitialized system memory in the concatenated output, potentially leaking sensitive information. The issue was fixed in version 1.0.6 by ensuring input is properly handled.
Affected products
- floridoo concat-with-sourcemaps >= 1.0.0, < 1.0.6
Timeline
- 2019-05-29: advisory: GitHub Advisory published
- 2019-05-29: patched: GitHub reviewed the vulnerability and fix