Executive brief
npm-registry-fetch is a library used by Node.js developers to interact with npm registries. Affected versions fail to redact authentication credentials (usernames and passwords) from log output, causing sensitive login information to be exposed in stdout and log files where system administrators or other users might view them.
Technical details
The vulnerability is an information exposure flaw (CWE-352) in npm-registry-fetch's handling of registry URLs containing embedded credentials in the format protocol://[user[:password]@]hostname. The library does not redact the password component before logging URLs to stdout and log files, allowing credentials to be exposed. This affects versions before 4.0.5 and versions 5.0.0 through 8.1.0. The vulnerability requires no authentication or network access to exploit—it simply occurs whenever the library logs a URL containing credentials. Patches are available in versions 4.0.5 and 8.1.1.
Affected products
- npm npm-registry-fetch < 4.0.5, >= 5.0.0 < 8.1.1
Timeline
- 2020-07-07: disclosed
- 2020-07-07: patched: Patches released in versions 4.0.5 and 8.1.1