Blog

ColdBox Elixir v3 Security Update

Eric Peterson January 22, 2021

Spread the word

Eric Peterson

January 22, 2021

Spread the word


Share your thoughts

On January 12, 2021 we became aware of a security vulnerability in ColdBox Elixir. If an application using ColdBox Elixir bundled any code that contained references to process.env without explicitly setting the value using the webpack.ProvidePlugin then the outputed bundle would contain an object of all the environment variables. This would happen even if it was a vendor library that checked for process.env.* which is very common - many libraries check for process.env.NODE_ENV to enable optimizations or additional development logging. Since JavaScript is shipped to user's browsers, these environment variables are leaked and should be considered comprimised. Many of our own environment variables used in our CI processes were leaked, including SSH keys, S3 credentials, and database credentials. We recommend that you rotate all keys that are in the environment resposible for bundling your code with ColdBox Elixir.

ColdBox Elixir v3.1.7 and later were released to patch this vulnerability. We urge you to upgrade right away. Note that all referenced environment variables (via process.env) need to be explicitly declared in your Elixir config file, whether referenced by your own application code or third-party dependencies. We've added two features to make this transition easier.

First, automatic NODE_ENV environments. Elixir will provide a NODE_ENV value to your bundled code based on the current Elixir environment. If you desire to control this manually, setting a NODE_ENV in your environment will take precedence.

Second, a mix.env method. This method takes an array of environment keys to provide to your bundled code. If any of the keys are missing, your build will fail. Alternatively, you can provide an object with keys being the environment variable name and the value being a fallback value if the key is missing. This method passes directly to webpack.EnvironmentPlugin, so all the features listed for that plugin apply.

We deeply regret this security vulnerability and any additional work it has caused you. Please upgrade ColdBox Elixir and rotate your secrets straightaway.

Add Your Comment

Recent Entries

Into the Box 2024 Last Early Bird Days!

Into the Box 2024 Last Early Bird Days!

Time is ticking, with less than 60 days remaining until the excitement of Into the Box 2024 unfolds! Don't let this golden opportunity slip away; our exclusive Early Bird Pricing is here for a limited time only, available until March 31st. Why wait? Secure your seat now and take advantage of this steal!

Maria Jose Herrera
Maria Jose Herrera
March 20, 2024
Ortus February Newsletter 2024

Ortus February Newsletter 2024

Welcome to Ortus Solutions’ monthly roundup, where we're thrilled to showcase cutting-edge advancements, product updates, and exciting events! Join us as we delve into the latest innovations shaping the future of technology.

Maria Jose Herrera
Maria Jose Herrera
March 06, 2024
Unveiling the Future of CFML Development - 3rd Round of Sessions

Unveiling the Future of CFML Development - 3rd Round of Sessions

Welcome back to our journey into the future of CFML development! As excitement continues to build for Into the Box 2024, we're thrilled to bring you the latest updates on what promises to be a transformative event. Continuing our blog post series, let's delve deeper into the third wave of session releases and discover the key surprises awaiting attendees. Learn More

Maria Jose Herrera
Maria Jose Herrera
March 01, 2024