CVE-2019-5413: Code Injection in morgan
Summary
CVE-2019-5413: Code Injection in morgan. Affects morgan versions < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The morgan package is an HTTP request logger middleware for Node.js. It provides a simple way to log incoming requests, including the request method, URL, status code, response time, and more. This package is widely used in Node.js applications to monitor and log HTTP traffic. However, versions of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.
Vulnerability Detail
The vulnerability in morgan allows an attacker to inject arbitrary code into the application when user input is not properly sanitized before being used in the filter. This can lead to remote code execution and other malicious activities. Additionally, the vulnerability can be combined with a prototype pollution attack, which allows an attacker to modify the behavior of existing objects in the application. This can result in further exploitation and compromise of the system.
How To Fix
Minimum fixed version
1.9.1
This is the first release that contains the fix.
npm install morgan@1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the morgan package is not immediately feasible, a workaround for the code injection vulnerability is to properly sanitize and validate user input before using it in the filter. This involves implementing input validation and sanitization techniques, such as using regular expressions or input validation libraries, to ensure that user input does not contain any malicious code. It is important to thoroughly review and test the implemented workaround to ensure its effectiveness and to consider updating to the latest version of the package as soon as possible.
Conclusion
The morgan package before version 1.9.1 is vulnerable to code injection and prototype pollution attacks. It is crucial to update to the latest version of the package to mitigate these security risks. Additionally, implementing proper input validation and sanitization techniques can provide temporary protection until the package is updated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for morgan →
FAQ
Morgan is an HTTP request logger middleware for Node.js that provides a simple way to log incoming requests.
Versions of morgan before 1.9.1 are vulnerable to code injection and prototype pollution attacks.
Code injection is a security vulnerability that allows an attacker to insert and execute arbitrary code in an application.
Prototype pollution is a vulnerability that allows an attacker to modify the behavior of existing objects in an application.
To protect your application, it is recommended to update to version 1.9.1 or later of the morgan package. Additionally, ensure that user input is properly sanitized and validated before using it in the filter.
Related vulnerabilities
Recent vulnerabilities recorded for morgan.
