World-Readable Log Files Vulnerability in node-log4js
Summary
DEBIAN-CVE-2022-21704: log4js-node is a port of log4js to node.js. Affects node-log4js versions < 6.3.0+~cs8.3.10-1+deb11u1. Fixed in 6.3.0+~cs8.3.10-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-log4js is a logging library for Node.js that provides a flexible logging framework. It allows developers to log messages in various formats and to different outputs, such as files or the console. The library is widely used in applications to facilitate debugging and monitoring. However, certain versions of node-log4js have a vulnerability that results in default file permissions for log files being set to world-readable, which can expose sensitive information.
Vulnerability Detail
The vulnerability arises from the default configuration of log4js-node, where log files created by the file, fileSync, and dateFile appenders have world-readable permissions on Unix systems. This means that any user on the system can read these log files, potentially exposing sensitive information such as user data, application secrets, or other confidential logs. This issue affects users who do not specify their own file permissions through the mode parameter in the configuration, leading to security risks.
How To Fix
Minimum fixed version
6.3.0+~cs8.3.10-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-log4jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set the file permissions for log files by specifying the mode parameter in the log4js configuration. For example:
log4js.configure({
appenders: {
file: {
type: 'file',
filename: 'logs/app.log',
mode: '0600' // Set permissions to read/write for owner only
}
},
categories: {
default: { appenders: ['file'], level: 'info' }
}
});
Conclusion
The node-log4js package has a significant vulnerability that can expose sensitive information through world-readable log files. It is crucial for users to update to the patched versions to mitigate this risk. Additionally, implementing proper file permissions in the configuration can serve as a temporary workaround.
See every vulnerability recorded for node-log4js →
FAQ
The vulnerability allows unauthorized users to read log files, which may contain sensitive information, leading to potential data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions include all versions prior to the fixed versions: 6.3.0+~cs8.3.10-1+deb11u1 for Debian 11 and 6.4.1+~cs8.3.5-1 for Debian 12, 13, and 14.
If an immediate update is not possible, ensure to set the file permissions manually using the mode parameter in your log4js configuration.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-log4js.
