CVE-2020-7674: Improper Input Validation in access-policy
Summary
CVE-2020-7674: Improper Input Validation in access-policy. Affects access-policy versions < 3.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
access-policy is an npm package that provides functionality for managing access policies. It allows users to define and enforce policies for accessing resources. However, versions up to 3.1.0 are vulnerable to Arbitrary Code Execution. This vulnerability arises from improper input validation in the template function, which leads to the execution of user-provided input by the eval function. As a result, an attacker can execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability in access-policy allows an attacker to execute arbitrary code on the affected system. By providing malicious input to the template function, an attacker can exploit the improper input validation and trigger the execution of their code through the eval function. This can lead to various consequences, including unauthorized access, data breaches, and system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the template function in access-policy or ensure that any user input passed to the function is properly validated and sanitized before being used. By implementing strict input validation and avoiding the use of potentially unsafe functions like eval, the risk of code execution can be mitigated.
Conclusion
In conclusion, access-policy versions up to 3.1.0 are vulnerable to Arbitrary Code Execution. It is crucial to upgrade to a secure version of the package and ensure that package dependencies are updated accordingly. Implementing proper input validation and avoiding the use of unsafe functions like eval can help mitigate the risk of code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for access-policy →
FAQ
access-policy is an npm package that provides functionality for managing access policies. It allows users to define and enforce policies for accessing resources.
This vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, and system compromise.
To fix this vulnerability, it is recommended to upgrade to a version of access-policy that is not affected by this issue. Ensure that your package dependencies are updated to use a secure version of access-policy.
As a workaround, users can avoid using the template function in access-policy or ensure that any user input passed to the function is properly validated and sanitized before being used.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for access-policy.
