Описание
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking one-request-per-line log structure and enabling log forgery against downstream consumers.
Отчет
The morgan npm logging middleware is vulnerable to log forgery via unneutralized control characters in the :remote-user token extracted from Basic Authorization headers. A remote unauthenticated attacker can send crafted requests to inject forged log lines, impacting log integrity. Built-in combined, common, default, and short formats are affected; fixed in morgan 1.11.0. Affects ODF mcg-core, RHDH, hummingbird nodejs, cryostat, AAP portal, and other npm morgan consumers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-pccs | Fix deferred | ||
| Cryostat 4 | cryostat/cryostat-openshift-console-plugin-rhel9 | Fix deferred | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Out of support scope | ||
| Red Hat Enterprise Linux 10 | linux-sgx | Fix deferred | ||
| Red Hat Enterprise Linux 9 | linux-sgx | Under investigation | ||
| Red Hat Fuse 7 | morgan | Out of support scope | ||
| Red Hat Hardened Images | nodejs20 | Will not fix | ||
| Red Hat Hardened Images | nodejs22 | Affected | ||
| Red Hat Hardened Images | nodejs24 | Affected | ||
| Red Hat Hardened Images | nodejs25 | Will not fix |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
5.3 Medium
CVSS3