CVE-2023-38704 import-in-the-middle allows unsanitized user controlled input in module generation

2023-08-0719:24:33

CWE-20

GitHub_M

www.cve.org

import-in-the-middle

remote code execution

patched version 1.4.2

ecmascript modules

loader hooks

user-supplied input

module generation

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

10 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.1%

JSON

import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the import() function. This vulnerability has been patched in import-in-the-middle version 1.4.2.

Some workarounds are available. Do not pass any user-supplied input to import(). Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the NODE_OPTIONS environment variable, that would enable loader hooks.

CNA Affected

[
  {
    "vendor": "DataDog",
    "product": "import-in-the-middle",
    "versions": [
      {
        "version": "< 1.4.2",
        "status": "affected"
      }
    ]
  }
]