CVE-2020-7677: Unsafe `eval` calls in thenify package
Summary
CVE-2020-7677: thenify before 3.3.1 made use of unsafe calls to eval. Affects thenify versions < 3.3.1. Fixed in 3.3.1. How to fix ↓
Also tracked for
- node-thenify · Debian:11
The same CVE-2020-7677 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thenify package is an npm module that provides a utility function for converting callback-based functions into Promise-based functions. It is commonly used in JavaScript applications to simplify asynchronous programming. The package allows developers to wrap callback-style functions and use them with Promises, improving code readability and maintainability. However, versions of thenify prior to 3.3.1 contain a vulnerability that makes use of unsafe calls to eval. This vulnerability can be exploited by an attacker to execute arbitrary code on the host system.
Vulnerability Detail
The vulnerability in thenify versions prior to 3.3.1 arises from the use of unsafe calls to eval. This allows an attacker to inject malicious code into user input, which is then executed by the eval function. As a result, the attacker can achieve arbitrary code execution on the host system. This can lead to various security risks, including unauthorized access, data breaches, and system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
3.3.1
This is the first release that contains the fix.
npm install thenify@3.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the thenify package to ensure the security of the application.
Conclusion
The thenify package prior to version 3.3.1 contains a critical vulnerability that allows arbitrary code execution. To mitigate this risk, it is recommended to update the package to version 3.3.1 or later. Failure to address this vulnerability can result in unauthorized access, data breaches, and system compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thenify →
FAQ
thenify is an npm package that provides a utility function for converting callback-based functions into Promise-based functions. It simplifies asynchronous programming in JavaScript applications.
The vulnerability allows an attacker to execute arbitrary code on the host system. This can lead to unauthorized access, data breaches, and system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
Yes, the vulnerability can be fixed by updating the thenify package to version 3.3.1 or later. The update removes the unsafe calls to eval.
There are no known workarounds for this vulnerability. It is crucial to update to the fixed version of the thenify package.
