CVE-2017-16059: Hijacked Environment Variables in mssql-node
Summary
CVE-2017-16059: mssql-node is malware. Affects mssql-node versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mssql-node package is a Node.js package that provides functionality for interacting with Microsoft SQL Server databases. It is commonly used in Node.js applications that require database connectivity to Microsoft SQL Server. However, all versions of the mssql-node package have been found to be compromised and have been unpublished from the npm registry.
Vulnerability Detail
The vulnerability in the mssql-node package involves the presence of malware that steals environment variables and sends them to attacker-controlled locations. This malware can potentially expose sensitive information, such as credentials and tokens, that are stored in environment variables. The impact of this vulnerability depends on the specific information that is stored in the environment variables and the actions that the attacker takes with the stolen data. It is important to note that the presence of this package in an environment indicates a security breach, and the focus should be on identifying how it was installed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The mssql-node package has been found to be compromised and should be removed from any environment where it is installed. It is crucial to investigate how the package was installed and take necessary steps to secure the environment. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mssql-node →
FAQ
You can check if the mssql-node package is installed in your environment by running the command npm ls mssql-node in your project directory or by inspecting the package.json files in your system.
If you find the mssql-node package installed in your environment, you should follow the recommended steps mentioned in the 'how_to_fix' section of this report.
No, it is not safe to use the mssql-node package even if it is not compromised. All versions of the package have been unpublished from the npm registry, indicating a security concern.
To prevent the installation of compromised packages, it is recommended to regularly update your packages to the latest versions, use package-lock.json to ensure deterministic installations, and verify the integrity of packages before installation.
No, there is no official fix or patch available for this vulnerability as the mssql-node package has been unpublished from the npm registry. The recommended course of action is to follow the steps mentioned in the 'how_to_fix' section of this report.
