Login Sign Up

CVE-2020-7677

8.6 HIGH
Remote Code Execution

📋 TL;DR

CVE-2020-7677 is a remote code execution vulnerability in the thenify npm package where user-controlled input is passed directly to the eval() function without sanitization. This allows attackers to execute arbitrary JavaScript code on affected systems. Any application using vulnerable versions of thenify is affected.

💻 Affected Systems

Products:
  • thenify npm package
Versions: All versions before 3.3.1
Operating Systems: All operating systems running Node.js
Default Config Vulnerable: ⚠️ Yes
Notes: Any application that uses thenify with user-controlled input to the name parameter is vulnerable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Thenify by Thenify Project

View all CVEs affecting Thenify →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full remote code execution leading to complete system compromise, data theft, and lateral movement within the environment.

🟠

Likely Case

Arbitrary code execution within the Node.js process context, potentially leading to application compromise and data exposure.

🟢

If Mitigated

No impact if input validation prevents malicious payloads from reaching the vulnerable function.

🌐 Internet-Facing: HIGH - Web applications using thenify could be exploited remotely without authentication.
🏢 Internal Only: MEDIUM - Internal applications could be exploited by authenticated users or through other attack vectors.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability is straightforward to exploit as it involves passing malicious JavaScript to the eval() function.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.3.1

Vendor Advisory: https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a

Restart Required: Yes

Instructions:

1. Update thenify package to version 3.3.1 or later using npm update thenify. 2. Restart the Node.js application to apply the fix.

🔧 Temporary Workarounds

Input validation and sanitization

all

Implement strict input validation to ensure the name parameter passed to thenify contains only expected characters.

Remove eval usage

all

Refactor code to avoid using thenify with user-controlled input or replace thenify with alternative libraries.

🧯 If You Can't Patch

  • Implement strict input validation and sanitization for all user inputs passed to thenify.
  • Use application firewalls or middleware to filter malicious payloads before they reach the vulnerable function.

🔍 How to Verify

Check if Vulnerable:

Check package.json or node_modules/thenify/package.json for version number below 3.3.1.

Check Version:

npm list thenify

Verify Fix Applied:

Verify thenify version is 3.3.1 or higher after update and test that user input no longer triggers eval execution.

📡 Detection & Monitoring

Log Indicators:

  • Unusual eval() executions in Node.js logs
  • Suspicious JavaScript code in application input logs

Network Indicators:

  • HTTP requests containing JavaScript payloads in parameters
  • Unusual outbound connections from Node.js process

SIEM Query:

source="nodejs" AND "eval" AND ("thenify" OR suspicious_javascript_patterns)

📊 Metadata

CVE ID: CVE-2020-7677
CVSS v3 Score: 8.6 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Published: July 25, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON