Cristianstaicu

OneUptime is an open-source monitoring and observability platform. The software uses the Node.js `vm` module as an isolation primitive. Because this API was not designed for isolation, it can be escaped through the use of error objects and infinite recursion.

Ghost, a Node.js content management system, is affected by a code execution issue. Maliciously crafted themes can execute arbitrary code on the server. It is recommended to avoid installing untrusted themes. If a malicious theme has already been installed, uninstall it and inspect it to understand its impact.

SandboxJS, a JavaScript sandboxing library, has a sandbox escape issue. This is due to a mismatch between the key used for validation and the key used for property access. The key, intended to be a string, is not enforced as such, allowing attackers to use malicious objects that change string values during sanitization and property access. This could lead to remote code execution if an attacker can execute code within the sandbox.

The security measures within enclave-vm are inadequate. The Abstract Syntax Tree (AST) sanitization can be circumvented using dynamic property accesses. The hardening of error objects does not fully address peculiar behavior within the vm module. Furthermore, the prevention of function constructor access can be bypassed by utilizing host object references. A bug in Node.js allows the vm module to leak host references during infinite recursion, which can be exploited to escape the sandbox. A proof of concept demonstrates the ability to execute arbitrary commands, such as reading the /etc/passwd file, by leveraging this vulnerability. This could lead to sandbox escape and potential escalations in related products like FrontMCP, AgentFront, and other Frontegg products. The exploit utilizes the `[[" proto "]]` property to access and modify prototype chains, ultimately leading to code execution. The vulnerable code involves a recursive function `a()` and manipulation of the `rootProt` object.

n8n is an open-source workflow automation platform. An authenticated user with permission to create or modify workflows can exploit crafted expressions in workflow parameters to trigger system command execution on the host running n8n. This allows for potential full server compromise, including the theft of API keys, credentials, and secrets. The issue stems from an expression escape vulnerability and incomplete AST-based sanitization. Public exploits are available.

Locutus, designed to bring standard libraries from other programming languages to JavaScript for educational purposes, contains a prototype pollution issue. A previous attempt to address prototype pollution by checking for forbidden keys in user input was insufficient. It remains possible to pollute `Object.prototype` through a crafted input utilizing `String.prototype`. This allows for malicious property injection, potentially leading to further compromise.

Tina is a headless content management system. Versions of Tina prior to 3.1.1 improperly utilize the gray-matter package, potentially allowing attackers who control the content of markdown files—such as blog posts—to execute arbitrary code.

Argo Workflows, a container-native workflow engine for Kubernetes, has an issue with unsafe untar code that improperly handles symbolic links within archives. A flaw exists in how a link's target is calculated and checked. This allows an attacker to overwrite the file `/var/run/argo/argoexec` with a malicious script, which would then be executed when the pod starts. The previously deployed patch is ineffective against archives containing malicious symbolic links.

The isolated-vm library for Node.js has API pitfalls that may expose supposed secure isolates to the permissions of the main Node.js isolate. `Reference` objects allow access to the underlying reference's full prototype chain, potentially enabling attackers to acquire a `Reference` to the Node.js context's `Function` object. Similar attacks could be possible by modifying the local prototype of other API objects. Access to `NativeModule` objects could allow an attacker to load and run native code from anywhere on the filesystem, potentially leading to arbitrary code execution if combined with a file upload API.

Name of the Vulnerable Software and Affected Versions: lodash versions prior to 4.17.11 Description: The issue is related to uncontrolled resource consumption, which can lead to a denial of service. It affects the date handler component. An attacker can exploit this by providing very long strings that the library attempts to match using a regular expression. Recommendations: For versions prior to 4.17.11, update to version 4.17.11 to resolve the issue. As a temporary workaround, consider restricting the input length for the date handler component to prevent very long strings from being processed.

Name of the Vulnerable Software and Affected Versions: string (affected versions not specified) Description: The issue concerns a regular expression denial of service that occurs when specifically crafted untrusted user input is passed into the `underscore` or `unescapeHTML` methods of the string module. Recommendations: Avoid passing user input to the `underscore` and `unescapeHTML` methods as a temporary workaround. Consider applying the user-provided patch available, although it has not been tested or merged by the package author, as an alternative solution.

Name of the Vulnerable Software and Affected Versions: timespan (affected versions not specified) Description: The timespan module is vulnerable to a regular expression denial of service. This issue can cause significant amplification, with 50,000 characters of untrusted user input resulting in the event loop being blocked for around 10 seconds. Recommendations: For all affected versions, consider using a functionally equivalent alternative package as a replacement for timespan. As a temporary workaround, ensure that user input is not being passed into timespan, or drastically reduce the maximum length of such user input, limiting it to 150 characters or less.

Name of the Vulnerable Software and Affected Versions: dns-sync versions (affected versions not specified) Description: The issue concerns an arbitrary command execution vulnerability in the `resolve()` method of dns-sync. This occurs when untrusted user input is allowed into the `resolve()` method, enabling command injection. Recommendations: - For all affected versions, do not allow untrusted input into `dns-sync.resolve()`. - As a temporary workaround, consider using an alternative dns resolver until a patch is available.

Name of the Vulnerable Software and Affected Versions: charset versions 1.0.0 and below Description: The issue concerns a regular expression denial of service. It is noted that an input of around 50,000 characters is required to cause a slow down of approximately 2 seconds. The impact of this issue is relatively low due to the default header max length in node being 80kb, unless node was compiled with a different header size limit using the `-DHTTP MAX HEADER SIZE` option. Recommendations: Update to version 1.0.1 or later.

Name of the Vulnerable Software and Affected Versions: slug versions prior to 0.9.2 Description: The issue concerns a regular expression denial of service in the slug module when specially crafted untrusted input is passed. This can cause the event loop to block for 2 seconds with approximately 50,000 characters. Recommendations: Update to version 0.9.2 or later.

Name of the Vulnerable Software and Affected Versions: Summit versions 0.1.0 and later Description: The issue allows an attacker to execute arbitrary commands via the collection name when using the PouchDB driver in the module. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For Summit versions 0.1.0 and later, avoid using the `PouchDB` driver as the package author has abandoned this feature entirely.