Malicious Package in body-parse-xml
Summary
GHSA-jcmh-9fvm-j39w: Malicious Package in body-parse-xml. Affects body-parse-xml versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The body-parse-xml package is an npm package that is used for parsing XML data in Node.js applications. It provides functionality to parse XML strings into JavaScript objects. This package is vulnerable to a critical security issue where it contains malicious code. When the package is installed and used in an application, it uploads system information such as the operating system and hostname to a remote server without the user's knowledge or consent.
Vulnerability Detail
The vulnerability in the body-parse-xml package allows an attacker to collect sensitive system information from the host machine without authorization. This can lead to potential privacy breaches and unauthorized access to sensitive data. The malicious code in the package uploads the collected information to a remote server, which can be used by the attacker for malicious purposes. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the package from the environment and follow the recommended steps for fixing the vulnerability.
Conclusion
The body-parse-xml package contains a critical security vulnerability where it uploads sensitive system information to a remote server without authorization. To mitigate this vulnerability, it is crucial to remove the package from the environment and follow the recommended steps for fixing the issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for body-parse-xml →
FAQ
The impact of this vulnerability is that sensitive system information can be collected and uploaded to a remote server without authorization. This can lead to privacy breaches and potential unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
There are no indications of further compromise mentioned in the vulnerability details. However, it is recommended to thoroughly review the affected environment and monitor for any suspicious activities.
Yes, the recommended fix for this vulnerability is to remove the body-parse-xml package from the environment. It is also important to review the package's source and consider using alternative packages with good security track records.
The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for body-parse-xml.
