CVE-2022-21704: Incorrect Default Permissions in log4js
Summary
CVE-2022-21704: Incorrect Default Permissions in log4js. Affects log4js versions < 6.4.0. Fixed in 6.4.0. How to fix ↓
Also tracked for
- node-log4js · Debian:11
The same CVE-2022-21704 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
log4js is an open-source logging framework for Node.js applications. It provides various logging appenders, including file, fileSync, and dateFile. These appenders allow developers to log information to files. However, prior to version 6.4.0, log4js had a vulnerability where the default file permissions for log files created by these appenders were world-readable in Unix systems. This could potentially expose sensitive information if the log files contain confidential data.
Vulnerability Detail
The vulnerability (CVE-2022-21704) in log4js arises from the incorrect default file permissions for log files. By default, the log files created by the file, fileSync, and dateFile appenders have world-readable permissions. This means that any user on the system can read the contents of these log files, potentially exposing sensitive information. The vulnerability affects users who have not specified their own permissions for the log files via the mode parameter in the configuration. The impact of this vulnerability depends on the nature of the information logged and the system's security context.
How To Fix
Minimum fixed version
6.4.0
This is the first release that contains the fix.
npm install log4js@6.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating log4js is not immediately feasible, a workaround is available. Developers can pass the mode parameter to the configuration of file appenders to explicitly set the desired file permissions. The mode parameter allows specifying the file mode in octal format. For example, to set the file permissions to read and write for the owner only, the mode parameter can be set to 600. It is important to review the documentation of log4js for the correct usage of the mode parameter.
Conclusion
The vulnerability in log4js (CVE-2022-21704) allows log files to have world-readable permissions by default, potentially exposing sensitive information. To mitigate this vulnerability, it is crucial to update log4js to version 6.4.0 or later. Additionally, developers can set the file permissions explicitly using the mode parameter in the configuration of file appenders. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for log4js →
FAQ
log4js is an open-source logging framework for Node.js applications. It provides various logging appenders and features to facilitate logging in Node.js projects.
The impact of this vulnerability depends on the contents of the log files and the system's security context. If the log files contain sensitive information, their world-readable permissions can expose that information to unauthorized users.
To fix this vulnerability, update log4js to version 6.4.0 or later. Alternatively, you can set the file permissions explicitly using the mode parameter in the configuration of file appenders.
Yes, all versions of log4js prior to 6.4.0 are affected by this vulnerability. It is recommended to update to the latest version to mitigate the issue.
Yes, if updating log4js is not immediately feasible, you can set the file permissions explicitly using the mode parameter in the configuration of file appenders. However, updating to the latest version is the recommended approach.
