Create-react-app: Vulnerable Dependency: macaddress

[leogonzalez]

Hi, apologies if this isn't the right place for this.

Using create-react-app and running npm audit (available as npm 6) returns a vulnerable dependency report with Critical tag:

=== npm audit security report ===

Package: macaddress
Dependency of: react-scripts
Path: react-scripts > css-loader > cssnano > postcss-filter-plugins > uniqid > macaddress
More info: https://nodesecurity.io/advisories/654

[barbalex]

npm audit outputs:

Run  npm install --dev [email protected]  to resolve 1 vulnerability

But according to https://github.com/facebook/create-react-app/issues/3815 the newest version is 2.0.0-next.66cc7a90.

What version should I install?

[gaearon]

From the vulnerability description you linked to:

For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

If you look at the code for uniqid you'll see this is not the case.

So there is no actual vulnerability you're being exposed to.

Feel free to send us a PR that bumps the package version when downstream packages stop using the vulnerable one but there is no issue that we need to address on our side.

[gabrielmoncea]

For this vulnerability to be exploited an attacker needs to control the iface argument to the one method
@gaearon can you explain what this means?

[gaearon]

It’s said here:

https://nodesecurity.io/advisories/654

For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

The macaddress package exports a method called one that takes a single argument. If that argument was supplied by an attacker they could trigger the vulnerability. However, in our case that argument is hardcoded in the uniq implementation I linked to above:

// ...
var mac = typeof __webpack_require__ !== 'function' ? require('macaddress').one(macHandler) : null ;
// ...
function macHandler(error){
  // ...
}

It’s not based on user input and can’t be controlled by an attacker. So there is no vulnerability in this case.

Does this explanation help?

[gabrielmoncea]

@gaearon you were really helpful !

[minyc510]

Hello, just commenting to report that I had the same issue and npm advised me to run
npm update postcss-filter-plugins --depth 4

Which did the trick.

[gaearon]

Stuff will break if you start updating internal packages without ejecting. You’ve been warned :-)

Going to lock this thread because there’s no actionable thing here for us. I’ll see if we can bump the dependency in 1.x branch. But again, there’s no real vulnerability here and you’re wasting effort trying to fix it.