Executive brief
moment-timezone is a JavaScript library that handles timezone-aware date and time operations. During its build process, the library downloads timezone data from IANA's servers. An attacker on the network could intercept these downloads over unencrypted FTP and inject malicious timezone data, potentially compromising the integrity of the built library and any application using it.
Technical details
The vulnerability is a cleartext transmission of sensitive information (CWE-319) in the moment-timezone build pipeline. The grunt build script downloaded timezone data from IANA via unencrypted FTP (ftp://ftp.iana.org/tz/tzdata-latest.tar.gz), allowing a network-positioned attacker to perform a man-in-the-middle attack. An attacker could serve malicious timezone data during the build process, potentially compromising the build artifact or the release pipeline. The vulnerability affects versions 0.1.0 through 0.5.34; patched in version 0.5.35, which switches to HTTPS endpoints. The attack requires the maintainer to run custom build commands and the attacker to be network-adjacent to intercept the FTP connection.
Affected products
- moment moment-timezone 0.1.0 through 0.5.34
Timeline
- 2022-08-23: advisory
- 2022-08-30: patched: version 0.5.35