Sign upLogin

andrewshawcare/thoughtworks-email-signature-generator

View on GitHub
Star

Showing 34 of 34 total issues

debug Regular Expression Denial of Service
Open

        "debug": {
          "version": "2.6.7",
          "from": "debug@2.6.7",
          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.7.tgz"
        },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

mime Regular Expression Denial of Service
Open

        "mime": {
          "version": "1.2.11",
          "from": "mime@>=1.2.11 <1.3.0",
          "resolved": "https://registry.npmjs.org/mime/-/mime-1.2.11.tgz"
        }
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Recommendation:

Upgrade to version 2.0.3 or greater.

ms Regular Expression Denial of Service
Open

        "ms": {
          "version": "0.7.0",
          "from": "ms@0.7.0",
          "resolved": "https://registry.npmjs.org/ms/-/ms-0.7.0.tgz"
        }
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

ms is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.

"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time."[1]

Proof of Concept

var ms = require('ms');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");

Results

Showing increase in execution time based on the input string. ``` $ time node ms.js 10000

real 0m0.758s user 0m0.724s sys 0m0.031s

$ time node ms.js 20000

real 0m2.580s user 0m2.494s sys 0m0.047s

$ time node ms.js 30000

real 0m5.747s user 0m5.483s sys 0m0.080s

$ time node ms.js 80000

real 0m41.022s user 0m38.894s sys 0m0.529s ```

Recommendation:

Update to version 0.7.1 or greater. An alternative would be to limit the input length of the user input before passing it into ms.

debug Regular Expression Denial of Service
Open

        "debug": {
          "version": "2.6.7",
          "from": "debug@2.6.7",
          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.7.tgz"
        },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

forwarded Regular Expression Denial of Service
Open

    "forwarded": {
      "version": "0.1.0",
      "from": "forwarded@>=0.1.0 <0.2.0",
      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.1.0.tgz"
    },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Recommendation:

If you are using this module via express, upgrade to Express version 4.15.5 or greater.

Upgrade to 0.1.2 or greater

mime Regular Expression Denial of Service
Open

    "mime": {
      "version": "1.3.4",
      "from": "mime@1.3.4",
      "resolved": "https://registry.npmjs.org/mime/-/mime-1.3.4.tgz"
    },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Recommendation:

Upgrade to version 2.0.3 or greater.

debug Regular Expression Denial of Service
Open

    "debug": {
      "version": "2.2.0",
      "from": "debug@>=2.2.0 <2.3.0",
      "resolved": "https://registry.npmjs.org/debug/-/debug-2.2.0.tgz"
    },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

cli Arbitrary File Write
Open

        "cli": {
          "version": "0.6.6",
          "from": "cli@>=0.6.0 <0.7.0",
          "resolved": "https://registry.npmjs.org/cli/-/cli-0.6.6.tgz",
          "dependencies": {
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Arbitrary File Write

Overview:

lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';

The package node-cli insecurely uses the lockfile and logfile. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

Recommendation:

Update to version 1.0.0 or later

debug Regular Expression Denial of Service
Open

        "debug": {
          "version": "2.1.3",
          "from": "debug@>=2.1.0 <2.2.0",
          "resolved": "https://registry.npmjs.org/debug/-/debug-2.1.3.tgz"
        },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

debug Regular Expression Denial of Service
Open

        "debug": {
          "version": "2.6.7",
          "from": "debug@2.6.7",
          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.7.tgz"
        },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

fresh Regular Expression Denial of Service
Open

    "fresh": {
      "version": "0.5.0",
      "from": "fresh@0.5.0",
      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.0.tgz"
    },
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

Fresh is a module used by the Express.js framework for 'HTTP response freshness testing'. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Recommendation:

If you are using this module via express, upgrade to Express version 4.15.5 or greater.

Upgrade to 0.5.2 or greater

debug Regular Expression Denial of Service
Open

            "debug": {
              "version": "2.6.6",
              "from": "debug@>=2.0.0 <3.0.0",
              "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.6.tgz",
              "dependencies": {
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Recommendation:

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

tough-cookie Regular Expression Denial of Service
Open

    "tough-cookie": {
      "version": "2.3.2",
      "from": "tough-cookie@>=2.3.0 <2.4.0",
      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.3.2.tgz",
      "optional": true
Severity: Minor
Found in npm-shrinkwrap.json by nodesecurity

Regular Expression Denial of Service

Overview:

The tough-cookie module is vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.

Unless node was compiled using the -DHTTPMAXHEADER_SIZE= option the default header max length is 80kb so the impact of the ReDoS is limited to around 7.3 seconds of blocking.

At the time of writing all version <=2.3.2 are vulnerable

Recommendation:

Please update to version 2.3.3 or greater

FIXME found
Open

            // FIXME: Figure out an elegant solution to updating out-of-scope DOM
Severity: Minor
Found in public/jsx/email_signature_generator.js by fixme
Severity
Category
Status
Source
Language