GHSA-qxc2-j82w-r537: High severity npm/@faker-js/faker vulnerability
Summary
faker.helpers.fake can be tricked into arbritary code execution.
Details
fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.
PoC
Go to https://fakerjs.dev/ Open Browser console and run
ts await enableFaker(); // or import faker faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function faker.helpers.fake({{test.constructor(alert('PowerLevel: Eval'))}});
Impact
The Fake method claims:
It is also NOT possible to use any non-faker methods or plain javascript in such patterns.
Which is objectively false, since any global gets fully accessible in the fake string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@faker-js/fakerto a version that resolves this vulnerability.Fixed in 10.5.0
Event History
Frequently Asked Questions
What conditions are needed to exploit this issue?
Exploitation requires a crafted pattern passed to faker.helpers.fake that reaches function properties during evaluation. The provided proof of concept also registers a definition that returns a function, then uses its constructor property to execute JavaScript.
Which applications are realistically exposed?
Applications are exposed when untrusted or attacker-influenced values can become faker.helpers.fake patterns, especially if an attacker can influence Faker raw definitions or other values resolved by those patterns. Uses limited to trusted, static patterns are not shown to be exploitable by the provided proof of concept.
What can be done before an update is available?
Do not pass untrusted strings to faker.helpers.fake, and prevent untrusted code or input from modifying faker.rawDefinitions. Restrict fake patterns to controlled static templates until the property-resolution behavior is corrected.
How can I check whether my use is affected?
Review calls to faker.helpers.fake for patterns built from request data, configuration controlled by lower-trust users, or other external input. Also review whether faker.rawDefinitions can be modified and whether definitions can return functions that a pattern could traverse.