The largest Node.js software package registry, npm, has revealed several security flaws that were recently discovered and patched.
The first flaw involves leaking private npm package names to the npmjs.com 'replica' server. While the second flaw allows attackers to publish new versions of any existing npm package that they do not own or have permissions to, due to improper authorization checks.
See also: Microsoft Patch Tuesday November 2021: Fixes 55 vulnerabilities
Private npm package names leaked
This week, npm's parent company, GitHub, disclosed two security flaws that were discovered and resolved in the npm registry between October and this month.
The first is a data leak in the npmjs replication server, which was caused by “routine maintenance.” The leak revealed a list of private npm packages, but not the contents of those packages during the maintenance window.
Note that while the contents of private packages were not disclosed, knowledge of private package names is enough for threat actors to conduct targeted dependency confusion and typosquatting attacks in an automated manner, as we have seen time and time again.
The leak specifically concerns private npm libraries of scope that resemble “@owner/package” and were created before October 20. The names of such libraries were exposed “between October 21 13:12:10Z UTC and October 29 15:51:00Z UTC,” according to GitHub.
See also: iOS 15.1: Are iPhones still vulnerable to two zero-day vulnerabilities?
The data leak was discovered by GitHub on October 26th, and on the 29th, all records containing private package names were deleted from npm’s replication database. However, GitHub warns that the replicate.npmjs.com service is still consumed by third parties, who may therefore continue to maintain a copy or “may have replicated the data elsewhere.”
To prevent such an issue from recurring, GitHub has made changes to the process for creating the public replication database, which is expected to eliminate the possibility of private package names being leaked in the future.
The flaw could allow unauthorized publication of new versions
Additionally, GitHub disclosed a serious bug that could "allow an attacker to publish new versions of any npm package using an account without proper authorization.".
This vulnerability resulted from improper authorization checks and data validation between multiple microservices processing requests to the npm registry.
See also: Google Chrome: Emergency update to fix zero-day vulnerabilities
Researchers Kajetan Grzybowski and Maciej Piechota have been credited with responsibly reporting the flaw through GitHub's security bug bounty program.
And, so far, there appears to be no evidence of exploitation. The vulnerability existed in the npm registry “beyond the time frame for which we have telemetry to determine if it has ever been exploited.”.
GitHub stated with great confidence that the vulnerability has not been exploited since at least September 2020.
Information source: bleepingcomputer.com
