-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elysia | npm | < 1.4.18 | 1.4.18 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patches indicates that the vulnerability is a code injection issue within the composeHandler function in src/compose.ts. This function is part of Elysia's Ahead-of-Time (AOT) compilation feature, where it generates optimized JavaScript code for handling routes.
The core of the vulnerability is that configuration values for cookies, specifically cookie.secrets and cookie.sign, were being directly concatenated into a string of JavaScript code. If an attacker could control these configuration values (e.g., through environment variables that the application uses to configure Elysia), they could inject malicious code. The provided POC and the patch itself confirm this. The initial patch (commit 26935bf76ebc43b4a43d48b173fc853de43bb51e) introduces a sanitization function, overrideUnsafeQuote, and applies it to the cookie secret values before they are written into the generated code. A subsequent commit (3af978663e437dccc6c1a2a3aff4b74e1574849e) extends this sanitization to cookie names as well, making the fix more robust.
Therefore, the composeHandler function is the exact location where the vulnerability exists and would be the primary function to appear in a runtime profile when the vulnerability is triggered. The vulnerability is triggered during the application's initialization phase when the routes are being compiled, not necessarily during a specific request, but the malicious code would execute upon a request to the affected route.
composeHandlersrc/compose.ts
A Semantic Attack on Google Gemini - Read the Latest Research