World-Readable Log Files in log4js-node Package - CVE-2022-21704
Summary
CVE-2022-21704: log4js-node is a port of log4js to node.js. Affects node-log4js across 2 version ranges.
< 6.3.0+~cs8.3.10-1+deb11u1
< 9fdbed5ad45d1b09b35c1ef5355ba726b60cb702
Fixed in 6.3.0+~cs8.3.10-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
log4js-node is a popular logging library for Node.js, designed to provide a flexible and powerful logging solution for applications. It offers various appenders for logging, including file, fileSync, and dateFile, which allow developers to log messages to files with customizable formats and levels. However, certain versions of log4js-node have a critical vulnerability that results in log files being created with world-readable permissions, potentially exposing sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability identified as CVE-2022-21704 arises from the default file permissions set for log files generated by the file, fileSync, and dateFile appenders in log4js-node. In affected versions, these log files are created with world-readable permissions on Unix systems, meaning any user on the system can read the contents of these files. This poses a significant risk if the logs contain sensitive information, such as user data, authentication tokens, or application errors. The issue originates from the lack of a specified mode parameter in the configuration, which would otherwise allow users to set appropriate permissions for their log files. The ramifications of this vulnerability can lead to data breaches and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
6.3.0+~cs8.3.10-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-log4jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set the file permissions of the log files after they are created. This can be done using the chmod command in Unix systems. For example, to set the permissions to be readable only by the owner, you can run: chmod 600 path/to/logfile.log. Additionally, users can specify the mode parameter in their log4js-node configuration to set custom permissions when creating log files.
Conclusion
CVE-2022-21704 presents a significant risk for applications using the log4js-node package due to the default world-readable permissions of log files. Users are strongly advised to update to the latest versions to mitigate this vulnerability and protect sensitive information. Additionally, implementing proper file permission settings in the logging configuration can further enhance security.
See every vulnerability recorded for node-log4js →
FAQ
CVE-2022-21704 is a vulnerability in the log4js-node package that allows log files to be created with world-readable permissions, potentially exposing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions include those prior to 6.3.0 for Debian 11 and prior to 6.4.1 for Debian 12 and 13.
If an immediate update is not possible, consider using the chmod command to restrict file permissions on existing log files as a temporary workaround.
The CVSS score for CVE-2022-21704 is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-log4js.
