Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-25760

CVE-2022-25760: Code injection in accesslog

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-25760
GHSA ID
GHSA-8m2f-74r2-x3f2
EPSS Score
0.62115%
CWE
CWE-94
Published
3/18/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
accesslognpm<= 0.0.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsafe usage of the Function constructor in the format handling logic. References explicitly point to line 6 of lib/compile.js where code generation occurs. The PoC demonstrates that attacker-controlled format strings get evaluated as code through this mechanism. As this is the core code generation point for log formatting, and there's direct evidence of vulnerable pattern matching the CWE-94 description, this function is conclusively vulnerable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ll v*rsions o* p**k*** ****sslo* *r* vuln*r**l* to *r*itr*ry *o** Inj**tion *u* to t** us*** o* t** *un*tion *onstru*tor wit*out input s*nitiz*tion. I* (*tt**k*r-*ontroll**) us*r input is *iv*n to t** *orm*t option o* t** p**k***'s *xport** *onstru*

Reasoning

T** vuln*r**ility st*ms *rom uns*** us*** o* t** `*un*tion` *onstru*tor in t** *orm*t **n*lin* lo*i*. R***r*n**s *xpli*itly point to lin* * o* `li*/*ompil*.js` w**r* *o** **n*r*tion o**urs. T** Po* **monstr*t*s t**t *tt**k*r-*ontroll** *orm*t strin*s