CVE-2015-8857
📋 TL;DR
A vulnerability in uglify-js versions before 2.4.24 allows attackers to bypass security mechanisms by exploiting improper boolean expression rewriting. This affects Node.js applications using vulnerable uglify-js for JavaScript minification, potentially leading to security control bypass or other impacts.
💻 Affected Systems
- uglify-js
📦 What is this software?
Uglifyjs by Uglifyjs Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass authentication, authorization, or other security controls in minified JavaScript code, potentially leading to complete system compromise.
Likely Case
Security bypass in applications relying on uglify-js for code minification, allowing circumvention of client-side security checks.
If Mitigated
Minimal impact if proper server-side validation and security controls are implemented independently of client-side code.
🎯 Exploit Status
Exploitation requires ability to influence JavaScript code that gets processed by vulnerable uglify-js.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.24 and later
Vendor Advisory: https://nodesecurity.io/advisories/39
Restart Required: No
Instructions:
1. Update uglify-js to version 2.4.24 or later using npm update uglify-js. 2. Rebuild and redeploy any applications using uglify-js. 3. Test minified JavaScript output for correctness.
🔧 Temporary Workarounds
Use alternative minifier
allTemporarily switch to a different JavaScript minification tool
npm uninstall uglify-js
npm install terser
🧯 If You Can't Patch
- Implement additional server-side validation for all security-critical operations
- Disable JavaScript minification in development/production environments
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list uglify-jsCheck Version:
npm list uglify-jsVerify Fix Applied:
Verify installed version is 2.4.24 or higher: npm list uglify-js | grep uglify-js📡 Detection & Monitoring
Log Indicators:
- Unexpected security bypass events
- Authentication failures from validated users
Network Indicators:
- Unusual client-side JavaScript behavior patterns
SIEM Query:
source="application" AND (event_type="auth_failure" OR event_type="security_bypass")