cyberchef/VULNERABILITY_TRACKING.md

Vulnerability Tracking and Remediation Plan

Last Updated: 2025-12-19 Audit Date: 2025-12-19 Total Vulnerabilities: 35 (8 Critical, 8 High, 11 Moderate, 8 Low)

---

Executive Summary

Current Status

• 🔴 Critical: 8 (5 fixable, 3 unfixable)
• 🟠 High: 8 (7 fixable, 1 unfixable)
• 🟡 Moderate: 11 (10 fixable, 1 unfixable)
• ⚪ Low: 8 (8 fixable, 0 unfixable)

Fixability

• ✅ Fixable: 30 vulnerabilities (86%)
• ❌ Unfixable: 5 vulnerabilities (14%)

Priority Actions

1. ⚡ IMMEDIATE: Fix 5 critical fixable vulnerabilities
2. 🔥 HIGH: Fix 7 high severity vulnerabilities
3. 📋 MEDIUM: Fix 10 moderate vulnerabilities
4. 🔍 REVIEW: Assess 5 unfixable vulnerabilities

---

Critical Vulnerabilities (8 total)

✅ Fixable Critical (5)

1. crypto-js - PBKDF2 Weakness (CRITICAL)

CVE: Related to PBKDF2 implementation Issue: PBKDF2 1,000 times weaker than specified in 1993 Affected: < 4.2.0 Fix: npm install crypto-js@^4.2.0 CVSS: N/A Status: 🔴 UNFIXED

Impact:

• Used in cryptographic operations
• Weak key derivation could compromise encryption
• Direct dependency

Remediation:

npm install crypto-js@^4.2.0 --save

Testing Required:

• Run crypto operations tests
• Verify PBKDF2 operations still work
• Check for breaking changes

---

2. form-data - Unsafe Random Boundary (CRITICAL)

CVE: CVE-2024-XXXX Issue: Uses unsafe random function for boundary selection Affected: >=4.0.0 <4.0.4 Fix: npm install form-data@^4.0.4 CVSS: N/A Status: 🔴 UNFIXED

Impact:

• Development dependency (lower risk)
• Could affect form uploads
• Predictable boundaries might allow attacks

Remediation:

npm install form-data@^4.0.4 --save-dev

---

3. jsonpath-plus - Remote Code Execution (CRITICAL)

CVE: CVE-2024-XXXX Issue: RCE vulnerability in JSONPath parsing Affected: < 10.2.0 Fix: npm install jsonpath-plus@^10.2.0 CVSS: 9.8 (CRITICAL) Status: 🔴 UNFIXED

Impact:

• HIGH - RCE is extremely dangerous
• Used for JSON querying operations
• Attacker could execute arbitrary code

Remediation:

npm install jsonpath-plus@^10.2.0 --save

Testing Required:

• Test JSONPath operations
• Verify backward compatibility
• Review operation: JSON query/manipulation

---

4. pbkdf2 - Uint8Array Input Silently Ignored (CRITICAL)

CVE: CVE-2024-XXXX Issue: Silently disregards Uint8Array input, returns static keys Affected: <= 3.1.2 Fix: npm install pbkdf2@^3.1.3 CVSS: N/A Status: 🔴 UNFIXED

Impact:

• CRITICAL - Returns static/predictable keys
• Breaks cryptographic guarantees
• Used in password hashing operations

Remediation:

npm install pbkdf2@^3.1.3 --save

---

5. sha.js - Type Check Bypass (CRITICAL)

CVE: CVE-2024-XXXX Issue: Missing type checks allow hash rewind and data crafting Affected: <= 2.4.11 Fix: npm install sha.js@^2.4.12 CVSS: N/A Status: 🔴 UNFIXED

Impact:

• Hash function integrity compromised
• Could allow hash collisions
• Used in various crypto operations

Remediation:

npm install sha.js@^2.4.12 --save

---

❌ Unfixable Critical (3)

1. babel-traverse (CRITICAL)

Issue: Multiple vulnerabilities in Babel 6.x Affected: All versions (Babel 6.x) Fix: Not available - EOL package Status: ❌ UNFIXABLE

Why Unfixable:

• Babel 6.x is end-of-life
• No security updates planned
• Transitive dependency of old babel plugins

Mitigation:

• Dev dependency only (not in production bundle)
• Used only during build time
• Risk: LOW (not exposed to users)

Action Plan:

1. Document as accepted risk
2. Monitor for workarounds
3. Consider migrating to Babel 7 (major effort)
4. Alternative: Remove babel-plugin-transform-builtin-extend if not needed

---

2. babel-template (CRITICAL)

Issue: Via babel-traverse Affected: All versions (Babel 6.x) Fix: Not available - EOL package Status: ❌ UNFIXABLE

Mitigation: Same as babel-traverse

---

3. babel-plugin-transform-builtin-extend (CRITICAL)

Issue: Via babel-traverse Affected: All versions Fix: Not available - EOL package Status: ❌ UNFIXABLE

Mitigation:

• Check if this plugin is actually needed
• If not needed, remove from package.json
• If needed, accept risk (dev-only)

---

High Severity Vulnerabilities (8 total)

✅ Fixable High (7)

1. axios - DoS Attack (HIGH)

CVE: GHSA-4hjh-wcwx-xvwj Issue: DoS through lack of data size check Affected: >=1.0.0 <1.12.0 Fix: npm install axios@^1.12.0 CVSS: 7.5 Status: 🟠 UNFIXED

Impact:

• Could cause denial of service
• Used for HTTP requests
• Memory exhaustion possible

Remediation:

npm install axios@^1.12.0 --save

---

2. glob - Command Injection (HIGH)

CVE: CVE-2024-XXXX Issue: Command injection via -c/--cmd flag Affected: >=10.2.0 <10.5.0 Fix: npm install glob@^10.5.0 CVSS: 7.3 Status: 🟠 UNFIXED

Impact:

• Development dependency
• Command injection could execute arbitrary commands
• Build-time risk

Remediation:

npm install glob@^10.5.0 --save-dev

---

3. jsonwebtoken - Unrestricted Key Type (HIGH)

CVE: CVE-2024-XXXX Issue: Could lead to legacy keys usage Affected: <=8.5.1 Fix: npm install jsonwebtoken@^9.0.0 CVSS: 7.6 Status: 🟠 UNFIXED

Impact:

• JWT operations affected
• Weak keys could be accepted
• Authentication bypass possible

Remediation:

npm install jsonwebtoken@^9.0.0 --save

Note: Major version bump - check for breaking changes

---

4. jws - HMAC Signature Verification (HIGH)

CVE: CVE-2024-XXXX Issue: Improperly verifies HMAC signatures Affected: <3.2.3 Fix: npm install jws@^3.2.3 CVSS: 7.5 Status: 🟠 UNFIXED

Impact:

• Signature verification could be bypassed
• Used in JWT/JWS operations
• Authentication integrity at risk

Remediation:

npm install jws@^3.2.3 --save

---

5. node-forge - ASN.1 Unbounded Recursion (HIGH)

CVE: CVE-2024-XXXX Issue: Unbounded recursion in ASN.1 parsing Affected: <1.3.2 Fix: npm install node-forge@^1.3.2 CVSS: 7.5 Status: 🟠 UNFIXED

Impact:

• DoS via stack overflow
• Certificate parsing affected
• Used in crypto operations

Remediation:

npm install node-forge@^1.3.2 --save

---

6. shelljs - Improper Privilege Management (HIGH)

CVE: GHSA-4rq4-32rv-6wp6 Issue: Privilege escalation possible Affected: <0.8.5 Fix: npm install shelljs@^0.8.5 CVSS: N/A Status: 🟠 UNFIXED

Impact:

• Development dependency (grunt-chmod)
• Privilege escalation in build scripts
• Low risk (dev-only)

Remediation:

npm install shelljs@^0.8.5 --save-dev

---

7. ws - DoS with Many Headers (HIGH)

CVE: GHSA-3h5v-q93c-6h6q Issue: DoS when handling many HTTP headers Affected: >=2.1.0 <5.2.4 Fix: npm install ws@^8.0.0 CVSS: 7.5 Status: 🟠 UNFIXED

Impact:

• WebSocket DoS
• Transitive dependency
• Memory exhaustion possible

Remediation:

npm install ws@^8.0.0 --save

---

❌ Unfixable High (1)

1. Various via babel-* dependencies

Status: See Critical Unfixable section

---

Moderate Severity Vulnerabilities (11 total)

Summary

Most moderate vulnerabilities are fixable and include:

• @babel/runtime - ReDoS
• @babel/helpers - ReDoS
• @eslint/plugin-kit - ReDoS
• webpack-dev-server - Source code theft
• tmp - Symlink vulnerability

Bulk Fix:

npm install @babel/runtime@^7.26.10 --save
npm install @babel/helpers@^7.26.10 --save-dev
npm install webpack-dev-server@^5.2.2 --save-dev
npm install tmp@^0.2.5 --save-dev

---

Low Severity Vulnerabilities (8 total)

All low severity vulnerabilities are fixable via npm audit fix.

---

Remediation Plan

Phase 1: Immediate (Day 1) - Critical

Target: Fix all 5 fixable critical vulnerabilities

# Run manual update script
./scripts/manual-security-update.sh

# Or manually:
npm install crypto-js@^4.2.0 --save
npm install form-data@^4.0.4 --save-dev
npm install jsonpath-plus@^10.2.0 --save
npm install pbkdf2@^3.1.3 --save
npm install sha.js@^2.4.12 --save

Testing:

• Run full test suite: npm test
• Build project: npm run build
• Manual smoke tests for crypto operations
• Verify no regressions

Success Criteria:

• 0 critical fixable vulnerabilities remaining
• All tests pass
• Build succeeds

---

Phase 2: High Priority (Week 1) - High Severity

Target: Fix all 7 fixable high vulnerabilities

npm install axios@^1.12.0 --save
npm install glob@^10.5.0 --save-dev
npm install jsonwebtoken@^9.0.0 --save  # MAJOR VERSION - careful!
npm install jws@^3.2.3 --save
npm install node-forge@^1.3.2 --save
npm install shelljs@^0.8.5 --save-dev
npm install ws@^8.0.0 --save

Testing:

• Run full test suite
• Test JWT/JWS operations specifically
• Test network operations (axios)
• Build and deploy to staging

Success Criteria:

• 0 high fixable vulnerabilities
• All JWT tests pass
• No breaking changes

---

Phase 3: Medium Priority (Week 1-2) - Moderate

Target: Fix all moderate vulnerabilities

npm install @babel/runtime@^7.26.10 --save
npm install @babel/helpers@^7.26.10 --save-dev
npm install webpack-dev-server@^5.2.2 --save-dev
npm install tmp@^0.2.5 --save-dev
# ... others

---

Phase 4: Cleanup (Week 2) - Low + Review

Target: Fix low severity, review unfixable

1. Run npm audit fix for remaining low severity
2. Review unfixable babel-* dependencies
3. Consider removing babel-plugin-transform-builtin-extend
4. Document accepted risks

---

Unfixable Vulnerabilities - Risk Assessment

babel-traverse, babel-template, babel-plugin-transform-builtin-extend

Risk Level: 🟡 MEDIUM (mitigated by context)

Why It's Acceptable:

1. Dev Dependencies Only

   • Not included in production bundle
   • Only used during build process
   • No runtime exposure

2. Limited Attack Surface

   • Attacker would need:
     • Access to build environment
     • Ability to modify build inputs
     • Execution during build time

3. EOL Package

   • Babel 6.x is end-of-life
   • No security updates planned
   • Industry-wide issue

Mitigation Strategies:

✅ Current:

• Build in isolated/sandboxed environment
• Code review of build scripts
• Monitor for exploits

🔄 Short-term:

• Investigate if babel-plugin-transform-builtin-extend is needed
• If not needed: remove from dependencies
• If needed: document accepted risk

📋 Long-term:

• Plan migration to Babel 7 (major effort)
• Or remove Babel entirely if possible
• Monitor for community workarounds

Decision: ACCEPT RISK (documented)

---

Automation Integration

GitHub Actions Workflow Updates

The security-auto-fix workflow should be updated to:

1. Prioritize fixes:

   # Fix critical first
   - run: npm install crypto-js@^4.2.0 --save
   - run: npm install jsonpath-plus@^10.2.0 --save
   # etc.
   

2. Skip unfixable:

   # Don't try to fix babel-* vulnerabilities
   # Document in PR why they're skipped
   

3. Test after each phase:

   - run: npm test
   - run: npm run build
   

Updated Script: scripts/manual-security-update.sh

See the new script that:

• Fixes vulnerabilities in priority order
• Skips unfixable ones
• Generates before/after report
• Provides rollback instructions

---

Monitoring and Maintenance

Weekly

• Run npm audit
• Check for new advisories
• Update this document

Monthly

• Review unfixable vulnerabilities for new fixes
• Check for package alternatives
• Update automated workflows

Quarterly

• Full security audit
• Review risk acceptance decisions
• Plan major dependency upgrades

---

Success Metrics

Target State (After Phase 1-2)

• 🔴 Critical: 0 fixable, 3 documented unfixable
• 🟠 High: 0 fixable, 0 unfixable
• 🟡 Moderate: 0 fixable, 0 unfixable
• ⚪ Low: 0

Current vs Target

Metric	Current	Target	Status
Critical Fixable	5	0	🔴 Not Met
High Fixable	7	0	🔴 Not Met
Moderate Fixable	10	0	🟡 In Progress
Total Fixable	30	0	🔴 Not Met
Unfixable (Accepted)	5	3-5	🟢 Acceptable

---

Quick Commands

# Check current status
npm audit

# Run manual fixes (recommended)
./scripts/manual-security-update.sh

# Fix critical only
npm install crypto-js@^4.2.0 jsonpath-plus@^10.2.0 pbkdf2@^3.1.3 sha.js@^2.4.12 --save
npm install form-data@^4.0.4 --save-dev

# Fix high severity
npm install axios@^1.12.0 jsonwebtoken@^9.0.0 jws@^3.2.3 node-forge@^1.3.2 ws@^8.0.0 --save
npm install glob@^10.5.0 shelljs@^0.8.5 --save-dev

# Test everything
npm test && npm run build

# Generate report
npm run security:triage:json

---

Document Owner: Security Team Next Review: 2025-12-26 Status: 🔴 ACTION REQUIRED