Vulnerabilities Dashboard - JavaScript

[mantel-group-nullify]

10 Potential vulnerability sources found in JavaScript files within this repo

⚠️ CRITICAL	🔴 HIGH	🔵 MEDIUM	⚪ LOW
0	0	10	0

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 386 in f6e2b78

sleepSeconds *= 0.5 * (1 + Math.random());

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 1056 in f6e2b78

const r = (Math.random() * 16) | 0;

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-185

Regex dos

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Lines 3913 to 3914 in f6e2b78

	var dir = path.dirname(file);
	var match = /^\w+:\/\/[^\/]*/.exec(dir);

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 5919 in f6e2b78

return Math.round(low + (Math.random() * (high - low)));

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-770

Detect new buffer

The application was found calling the new Buffer constructor which has been deprecated
since Node 8.
By passing in a non-literal value, an adversary could allocate large amounts of memory.

Other issues also exist with the Buffer constructor:

• Older versions would return uninitialized memory, which could contain sensitive information
• Unable to easily determine what a Buffer contained if passed a non-literal value

To remediate this issue, use Buffer.alloc or Buffer.from instead to allocate a new
Buffer.

Example using Buffer.alloc instead of new Buffer(...):

// Create a new buffer using Buffer.from
const buf = Buffer.from([1, 2, 3, 4]);
// Work with buf

For more information on migrating to Buffer.from()/Buffer.alloc() see:

• https://nodejs.org/en/docs/guides/buffer-constructor-deprecation

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 6469 in f6e2b78

: new Buffer(string, encoding)

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-770

Detect new buffer

The application was found calling the new Buffer constructor which has been deprecated
since Node 8.
By passing in a non-literal value, an adversary could allocate large amounts of memory.

Other issues also exist with the Buffer constructor:

• Older versions would return uninitialized memory, which could contain sensitive information
• Unable to easily determine what a Buffer contained if passed a non-literal value

To remediate this issue, use Buffer.alloc or Buffer.from instead to allocate a new
Buffer.

Example using Buffer.alloc instead of new Buffer(...):

// Create a new buffer using Buffer.from
const buf = Buffer.from([1, 2, 3, 4]);
// Work with buf

For more information on migrating to Buffer.from()/Buffer.alloc() see:

• https://nodejs.org/en/docs/guides/buffer-constructor-deprecation

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 6487 in f6e2b78

: new Buffer(value)

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-185

Regex dos

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Lines 7081 to 7090 in f6e2b78

	var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, '[$1]') : givenKey;
	// The regex chunks
	var brackets = /(\[[^[\]]*])/;
	var child = /(\[[^[\]]*])/g;
	// Get the parent
	var segment = options.depth > 0 && brackets.exec(key);

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

secret-sharer-server/.webpack/create-billing-portal-session/create-billing-portal-session.js

Line 7931 in f6e2b78

Math.round(Math.random() * 1e16) + Math.round(Math.random() * 1e16)

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-208

Detect possible timing attacks

The application was found executing string comparisons using one of ===, !==, == or !=
against security sensitive values. String comparisons like this are not constant time, meaning
the
first character found not to match in the two strings will immediately exit the conditional
statement.
This allows an adversary to calculate or observe small timing differences depending on the
strings
passed to this comparison. This potentially allows an adversary the ability to brute force a
string
that will match the expected value by monitoring different character values.

To remediate this issue, use the crypto.timingSafeEqual method when comparing strings.

Example using crypto.timingSafeEqual to safely compare strings:

function constantTimeIsPasswordEqual(userInput) {
    // Retrieve the password from a secure data store such as a KMS or Hashicorp's vault.
    const password = getPasswordFromSecureDataStore();
    // Use crypto timingSafeEqual to ensure the comparison is done in constant time.
    return crypto.timingSafeEqual(Buffer.from(userInput, 'utf-8'), Buffer.from(password,
'utf-8'));
}

For more information on constant time comparison see:

• https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b

secret-sharer-server/get.js

Lines 98 to 112 in f6e2b78

	if (hash !== clientHash) {
	// Increment failedRetrievaals counter, update lastFailedRetrievalAt data and send error to client
	let incrementFailedRetrievals = 1;
	if (failedRetrievals) {
	incrementFailedRetrievals = failedRetrievals + 1;
	}
	const now = Date.now();
	console.log(typeof(incrementfailedRetrievals));
	console.log(typeof(now));
	console.log(typeof(id));
	const expiresAt = data.Item.expiresAt;
	const x = {
	TableName: process.env.tableName,
	// 'Key' defines the key of the item to be retrieved
	Key: {

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-208

Detect possible timing attacks

The application was found executing string comparisons using one of ===, !==, == or !=
against security sensitive values. String comparisons like this are not constant time, meaning
the
first character found not to match in the two strings will immediately exit the conditional
statement.
This allows an adversary to calculate or observe small timing differences depending on the
strings
passed to this comparison. This potentially allows an adversary the ability to brute force a
string
that will match the expected value by monitoring different character values.

To remediate this issue, use the crypto.timingSafeEqual method when comparing strings.

Example using crypto.timingSafeEqual to safely compare strings:

function constantTimeIsPasswordEqual(userInput) {
    // Retrieve the password from a secure data store such as a KMS or Hashicorp's vault.
    const password = getPasswordFromSecureDataStore();
    // Use crypto timingSafeEqual to ensure the comparison is done in constant time.
    return crypto.timingSafeEqual(Buffer.from(userInput, 'utf-8'), Buffer.from(password,
'utf-8'));
}

For more information on constant time comparison see:

• https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b

secret-sharer-server/handler.js

Lines 125 to 139 in f6e2b78

	if (token === clientToken) {
	// Delete entry from parameter store prior to sending back to client
	// Consider addng a counter or rate limit to prevent brute forcing
	secret = data.Parameter.Value.slice(0,-36); // strip the last 36 characters (token)
	message = "Token matched successfully";
	//console.debug(`Debug: Client Token: ${clientToken}, Token: ${token}, Message: ${message}`);
	}
	else {
	// Return an Error
	err = true;
	message = "Incorrect Token";
	console.warn(`Token did not match, Client provided token: ${clientToken}`);
	//console.debug(`Token did not match, Client Token: ${clientToken}, Token: ${token}, Message: ${message}`);
	}