GHSA-89fq-598q-39wc: 
JavaScript vulnerability analysis and mitigation

Summary

AuditLogger.verifyIntegrity() checked each remaining record on its own and never the chain between them, so deleted, reordered or truncated audit records were not detected, and an edited record passed when its signature field was removed. Separately, queryLogs() and generateComplianceReport() could return other tenants' events when the tenant filter was null, undefined or missing. Fixed in 3.8.2.

Details

Affected package

Main package only (src/enterprise). The integrity issue is in AuditLogger from 2.1.9; it was documented as tamper detection from 2.4.4 and as a tamper-evident audit trail from 2.5.0.

Patches

3.8.2. Records are chained and keyed: sequence numbers and chain links are assigned when a record is written and continue across restarts, and the links and each record's integrity hash are HMACs keyed with the signing key. verifyIntegrity() reports chain breaks, sequence gaps, unreadable lines and records written with another key, and a missing signature is reported for records written with signing on. Tenant filters that are present but not strings throw a TypeError, the underscore form no longer replaces the plain one, and reports without a tenant are deprecated in favour of allTenants: true.

Behaviour changes

Without signingKey or RAG_AUDIT_SIGNING_KEY, a key is stored in logDir/integrity/ (it only detects accidental damage and casual edits); switching to a configured key makes earlier records count as otherKey. Records written before 3.8.2 are reported as unchained, not tampered. See CHANGELOG 3.8.2, Changed. The webhookUrl option has never sent events; from 3.8.2 setting it logs a warning. Use a log shipper to keep copies elsewhere.

Workarounds

Pass a stable signingKey. Copy the log files off the host as they are written, to append-only storage. Restrict write access to the log directory to the process that writes it. Always pass a string tenantId to queryLogs() and generateComplianceReport().

Proof of concept

Step-by-step reproduction details are withheld for now so that users have time to upgrade. The affected configurations are described under Details and Impact. Release 3.8.2 adds regression tests for each issue in this advisory; they fail on 3.8.1 and pass on 3.8.2.

Impact

• Applications that rely on AuditLogger.verifyIntegrity() to detect tampering: someone who can write to the log directory could delete, reorder or truncate records, or edit a record and remove its signature, and verification still passed. The per-record hash covered only some fields and was not keyed. One unreadable line made queryLogs() and verifyIntegrity() fail for the whole range.
• Multi-tenant applications using queryLogs() or generateComplianceReport(): a tenant filter given as null or undefined was ignored, the underscore form could replace the plain one, and a report without a tenant covered every tenant, so one tenant could be shown another tenant's events.