Executive Summary

The vulnerability exists in the morgan logging middleware for Node.js, specifically in the :remote-user token. This token extracts the Basic authentication username from the Authorization request header and writes it to the log stream without neutralizing control characters like carriage return (CR) or line feed (LF).

An unauthenticated attacker can exploit this by sending a crafted Authorization Basic header containing CR or LF characters, which allows them to inject forged log lines. This breaks the one-request-per-line structure of access logs and enables log forgery against downstream log consumers.

The vulnerability affects morgan versions 1.2.0 through 1.10.1 and impacts the built-in combined, common, default, and short log formats, as well as any custom format that references :remote-user.

The issue has been fixed in morgan version 1.11.0 by neutralizing control characters in the :remote-user token output. A temporary workaround is to use a custom log format string that does not include :remote-user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to inject forged log entries into your access logs by exploiting the improper handling of control characters in the :remote-user token.

Such log forgery can disrupt the integrity and reliability of your logs, making it difficult to accurately track and audit user activity or system events.

It may also enable attackers to hide their malicious activities or create misleading log entries, which can hinder incident response and forensic investigations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring your HTTP access logs for suspicious or malformed entries that indicate log forging attempts, such as unexpected line breaks or injected log lines caused by control characters in the Authorization Basic header.

You can also inspect network traffic or captured HTTP requests to identify Authorization headers containing carriage return (CR) or line feed (LF) characters.

Suggested commands include using tools like grep or awk to search logs or captured traffic for suspicious patterns.

• grep -P '\r|\n' access.log # Search for carriage return or line feed characters in logs
• tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep 'Authorization: Basic' # Capture HTTP traffic and filter for Authorization headers
• Use a script or tool to parse logs and detect multiple log lines injected by a single request, indicating log forging.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps are to upgrade the morgan package to version 1.11.0 or later, where the vulnerability is patched by neutralizing control characters in the :remote-user token.

If upgrading is not immediately possible, a temporary workaround is to use a custom log format string that does not include the :remote-user token, thereby avoiding the vulnerable code path.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to inject forged log lines by exploiting improper neutralization of control characters in the :remote-user token of the morgan logging middleware. Such log forging can compromise the integrity and reliability of access logs.

Since accurate and tamper-proof logging is critical for compliance with standards like GDPR and HIPAA, which require secure audit trails and protection of sensitive information, this vulnerability could negatively impact compliance by enabling log manipulation and potentially obscuring unauthorized access or other security events.

Mitigating this vulnerability by upgrading to morgan 1.11.0 or avoiding the :remote-user token in log formats is important to maintain compliance with these regulations.

Useful 0 Not Useful 0