Jonchurch

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.

**Nome do Software Vulnerável e Versões Afetadas** morgan versões anteriores a 1.12.0 **Description** Existe um problema no auxiliar interno utilizado para escapar valores de tokens de log. O software não neutraliza os caracteres de separação de linha Unicode U+0085 (Next Line), U+2028 (Line Separator) e U+2029 (Paragraph Separator). Um cliente remoto não autenticado pode injetar esses caracteres em um token de log controlado pelo invasor, como um nome de usuário de autenticação Basic processado através do token `remote-user`. Isso permite a falsificação de logs (log forging), onde sistemas de processamento de logs subsequentes compatíveis com Unicode dividem um único log de requisição em múltiplos registros lógicos. **Recommendations** Atualize para a versão 1.12.0.

**Name of the Vulnerable Software and Affected Versions** Lodash versions prior to 4.18.0 **Description** Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior. **Recommendations** Upgrade to version 4.18.0 or later.

**Name of the Vulnerable Software and Affected Versions** lodash versions prior to 4.18.0 **Description** The software contains a flaw related to template compilation. Specifically, insufficient validation of key names within the `options.imports` object used by the ` .template` function can allow an attacker to inject default-parameter expressions, leading to arbitrary code execution. The issue arises because validation applied to the `option` variable is not extended to the `options.imports` key names. Furthermore, the use of `assignInWith` can introduce vulnerabilities if `Object.prototype` has been compromised, potentially copying polluted keys into the imports object and ultimately executing malicious code. **Recommendations** Upgrade to version 4.18.0. Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.