Timeline for Are devDependencies in Node.js exploitable?
Current License: CC BY-SA 4.0
22 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 16, 2021 at 1:43 | vote | accept | LGDGODV | ||
| S Oct 27, 2021 at 4:06 | history | bounty ended | CommunityBot | ||
| S Oct 27, 2021 at 4:06 | history | notice removed | CommunityBot | ||
| S Oct 21, 2021 at 15:19 | history | suggested | Sir Muffington | CC BY-SA 4.0 |
Improved formatting, added more grammatical clarity, fixed spelling and some stylistic changes
|
| Oct 20, 2021 at 18:00 | history | tweeted | twitter.com/StackSecurity/status/1450884568945463310 | ||
| Oct 20, 2021 at 17:44 | review | Suggested edits | |||
| S Oct 21, 2021 at 15:19 | |||||
| Oct 20, 2021 at 17:10 | comment | added | Sir Muffington |
@LGDGODV let me know if you need more examples :-) I added the event-stream vulnerability, since it was the one that made headlines.
|
|
| Oct 20, 2021 at 16:53 | answer | added | Sir Muffington | timeline score: 6 | |
| Oct 20, 2021 at 16:12 | comment | added | Sir Muffington | @LGDGODV I get the gist of it now, thanks. It's actually a brilliant question, let me summarize it all in an answer. | |
| Oct 20, 2021 at 5:52 | comment | added | LGDGODV | @SirMuffington thanks. Right, and I am thinking about the vulnerabilities reside in devdependencies. Are they exploitable when I am using those devdependencies to develop some software? If yes, are there any real-world exploits like this? For example, during my developing phase, is it possible for an attacker to exploit the vulnerability resides in the development dependency (such as "Eslint", "Webpack", "Codecov") to inject malicious code into the software I am developing? Real-world examples are better. Thanks. | |
| Oct 19, 2021 at 19:25 | comment | added | Sir Muffington |
@LGDGODV this appears like a question within my expertise, but could you please clarify what you ask? Your title appears to be a bit misleading as well. Are you talking about package vulns visible in this case when you run npm audit?
|
|
| Oct 19, 2021 at 4:55 | answer | added | CBHacking | timeline score: 6 | |
| Oct 19, 2021 at 4:25 | comment | added | Nelson | You're basically asking "is an unexploitable vulnerability exploitable?" which is an absurd question. You already claimed that these vulnerabilities are "not exploitable or very hard to exploit". The point is if you trust your other defenses enough, then you can do whatever you want. You didn't specify how you arrived at your initial premise. If you're asking a more general question, say "What are the attack vectors in a vulnerable development dependency?" then people can answer. | |
| Oct 19, 2021 at 4:19 | comment | added | LGDGODV | @Nelson, I am referring to "development dependency" here instead of runtime dependencies. Specifically, I want to know whether there are real-world exploits of such scenarios since many vulnerabilities are not exploitable or very hard to exploit. | |
| Oct 19, 2021 at 3:30 | comment | added | Nelson | You can literally just create this scenario out of thin air. Take any random old package, look at the exploits, and right there, it is exploitable. If you're using v1, you did not upgrade, but they fixed it in v2, that vulnerability is sitting in your old package. I have no idea why this needs to be asked. | |
| Oct 19, 2021 at 2:56 | history | edited | LGDGODV | CC BY-SA 4.0 |
added 10 characters in body
|
| S Oct 19, 2021 at 2:55 | history | bounty started | LGDGODV | ||
| S Oct 19, 2021 at 2:55 | history | notice added | LGDGODV | Authoritative reference needed | |
| Oct 15, 2021 at 8:14 | history | edited | LGDGODV | CC BY-SA 4.0 |
added 24 characters in body
|
| Oct 15, 2021 at 6:19 | history | edited | LGDGODV | CC BY-SA 4.0 |
added 64 characters in body
|
| S Oct 15, 2021 at 6:11 | review | First questions | |||
| Oct 15, 2021 at 10:56 | |||||
| S Oct 15, 2021 at 6:11 | history | asked | LGDGODV | CC BY-SA 4.0 |