PT-2022-1771 · Unknown · Log4Js-Node

Ranjit-Git · Published 2022-01-19 · Updated 2023-02-03 · CVE-2022-21704

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions log4js-node versions prior to 6.4.0

Description The issue is related to the default file permissions for log files created by the file, fileSync, and dateFile appenders in log4js-node, which are world-readable in Unix. This could cause problems if log files contain sensitive information, affecting users who have not supplied their own permissions for the files via the mode parameter in the config.

Recommendations For versions prior to 6.4.0, update to log4js@6.4.0 to fix the issue. As a temporary workaround, consider passing the mode parameter to the configuration of file appenders to set custom permissions, as allowed by every version of log4js.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

AZL-45261

BDU:2022-01070

CVE-2022-21704

DLA-3229-1

GHSA-82V2-MX6X-WQ7Q

Affected Products

Log4Js-Node

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21704.json · Exploit
• https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q · Patch
• https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76 · Patch
• https://github.com/log4js-node/streamroller/pull/87 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21704 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21704 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3229-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-82v2-mx6x-wq7q · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21704 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21704 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21704 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21704 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01070 · Security Note