Executive brief
node-rules is a JavaScript library used to implement business rules engines in applications. Versions before 5.0.0 fail to sanitize user-supplied rule input before passing it to an eval() call, allowing attackers to execute arbitrary code if rules are controlled by an untrusted source. This could lead to complete system compromise depending on the application's context.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the fromJSON() function of node-rules. The function directly evaluates unsanitized user-provided rule definitions without any input validation, allowing arbitrary JavaScript code execution through prototype pollution or direct code injection. The attack requires the application to call fromJSON() with user-controlled input, but no authentication is required. An attacker can execute arbitrary code in the system with the privileges of the Node.js process. The vulnerability was fixed in version 5.0.0 by removing the vulnerable fromJSON() and toJSON() functions from the exposed API.
Affected products
- npm node-rules <5.0.0
Timeline
- 2020-03-16: disclosed: Vulnerability disclosed to maintainers via Snyk Security
- 2020-09-03: patched: Fixed in version 5.0.0 by removing fromJSON/toJSON from exposed API
- 2020-09-03: advisory: Advisory published as GHSA-8whr-v3gm-w8h9