Executive brief
UglifyJS is a popular JavaScript minification and compression tool used in web development build pipelines. A vulnerability in versions before 2.4.24 allows attackers to bypass security mechanisms by exploiting improper rewriting of boolean expressions during code minification, potentially enabling malicious code injection or circumvention of security checks in downstream applications.
Technical details
The vulnerability is a logic flaw in UglifyJS's boolean expression rewriting mechanism. The minifier fails to properly account for non-boolean values when transforming boolean expressions, allowing attackers to craft JavaScript that behaves differently after minification. This can enable security bypass (e.g., circumventing access controls or validation logic) or unspecified malicious behavior. The vulnerability affects all versions before 2.4.24, and is fixed in version 2.4.24 and later. Exploitation requires the attacker to control or influence the JavaScript code being minified.
Affected products
- UglifyJS UglifyJS before 2.4.24
Timeline
- 2018-10-09: disclosed: Published to GitHub Advisory Database
- 2020-06-17: other: Advisory withdrawn as accidental duplicate publish (refers to CVE-2015-8857)