Executive brief
npm-groovy-lint is a Node.js package used to lint Groovy code during development and CI/CD workflows. Versions before 9.1.0 bundle a vulnerable version of Apache Log4j that can be exploited for remote code execution through a JNDI injection attack, potentially allowing an attacker to execute arbitrary code on systems running the linter.
Technical details
npm-groovy-lint versions prior to 9.1.0 bundle Log4j 2.13.0, which is vulnerable to CVE-2021-44228 (Log4j JNDI RCE). The vulnerability stems from unsafe deserialization of untrusted data in Log4j's message rendering when JNDI lookups are enabled. An attacker can craft malicious input that triggers a JNDI lookup to an attacker-controlled server, leading to arbitrary code execution. The attack vector requires the application to log attacker-controlled data. The vulnerability was fixed in npm-groovy-lint 9.1.0 by upgrading to a patched version of Log4j (2.15.0 or later).
Affected products
- npm npm-groovy-lint before 9.1.0
Timeline
- 2021-12-13: disclosed: GitHub issue opened requesting Log4j upgrade
- 2021-12-14: patched: Fix merged; version 9.1.0 released with Log4j 2.15.0 or later
- 2021-12-20: advisory: GitHub advisory GHSA-qc22-qwm9-j8rx published