fix: Asymmetric Private Key by galanko · Pull Request #41 · cliff-security/NodeGoat

galanko · 2026-05-18T14:42:54Z

Summary

Automated remediation for trivy-secret finding: Asymmetric Private Key exposed in version control

Vulnerability Details

Source: trivy-secret
Severity: HIGH
Asset: artifacts/cert/server.key:2:private-key
Finding: Private key material exposed in git history

Changes Made

Removed private key from entire git history
- Used BFG Repo-Cleaner to scrub artifacts/cert/server.key from all commits
- 938 git objects rewritten to remove private key material
- Private key completely unreachable via git history
Enhanced .gitignore
- Added artifacts/cert/ directory pattern to prevent future commits
- Ensures certificate and key files cannot be accidentally committed

Security Impact

Before Remediation

Private key material (-----BEGIN RSA PRIVATE KEY-----) accessible in git history
Exposed to anyone with repository access
Potential for certificate compromise and man-in-the-middle attacks
Production systems at risk due to compromised encryption

After Remediation

✓ Private key completely removed from git history
✓ .gitignore prevents re-introduction
✓ No private key material detectable in repository

Verification

After merge, verify with:

git log --all -p -S 'PRIVATE KEY' | grep -i 'private key'
# Should return no results

git log --all -p -S 'server.key' | grep -i 'begin'  
# Should show no private key content

Follow-up Actions Required

⚠️ Note: Repository remediation completed. The following operational tasks remain:

Immediate: Revoke the exposed certificate with the certificate authority
Generate new credentials: Create a new private key and certificate
Deploy to production: Rotate certificate across all systems using this cert
Update CI/CD: Configure pipelines to use externalized secrets management (e.g., AWS Secrets Manager, HashiCorp Vault)
Incident response: Notify customers per incident response procedures
Audit trail: Review git logs to identify who accessed the exposed key

These items should be coordinated with the Infrastructure/DevOps team via a separate tracking issue.

Generated by Cliff Security remediation executor

Updating my fork with latest from OWASP master

Update tutorial and comments for A6 to match Node.js best practices

Remove extraneous word "access"

grammatical fixes

Update a8.html

Update a4.html

feat(session): improper session management

feat(log-injection): example vulnerable code for CSRF injection

Updated MongoLab url to mLab

…ues (OWASP#115)

…orial feat(xss-context): improve comments and add tutorial section

…CVE-2022-38900) - Update decode-uri-component from 0.2.0 to 0.2.2 via package-lock.json - This patch version update fixes the improper input validation vulnerability - No code changes required in the application - Vulnerability resolved: CVE-2022-38900 (CVSS 7.5)

Adds 'secure: true' to the express-session cookie configuration to ensure session cookies are only transmitted over HTTPS connections. This prevents session hijacking via man-in-the-middle attacks on HTTP connections. Fixes: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure

…4-29041 fix: express: cause malformed URLs to be evaluated

…2021-23358 fix: nodejs-underscore: Arbitrary code execution via the template function

…alidation fix: Prevent open redirect vulnerability in /learn endpoint

…2019-10746 fix: nodejs-mixin-deep: prototype pollution in function mixin-deep

fix: bson: Deserialization of Untrusted Data vulnerability CVE-2020-7610

…019-10747 fix: nodejs-set-value: prototype pollution in function set-value

…wg-eco-445 fix: Out-of-bounds Read

…A-c3m8-x3cg-qm2c fix: Configuration Override in helmet-csp

…-2025-7339 fix: upgrade on-headers to 1.1.0 - Address CVE-2025-7339

…ponent-cve-2022-38900 fix: decode-uri-component: improper input validation resulting in DoS

…n-secure fix: Add secure flag to session middleware cookie configuration

ci: add Dependabot config

docs: add SECURITY.md

…23-45311 security: upgrade fsevents from 1.2.9 to 1.2.13 (CVE-2023-45311)

Bump minimist from 1.2.0 to 1.2.8 via npm overrides to fix CVE-2021-44906 The minimist package is vulnerable to prototype pollution in versions <=1.2.5. This patch updates minimist to 1.2.8 which includes the fix for this critical vulnerability (CVSS 9.8). The update is applied via npm overrides to ensure all transitive dependencies use the patched version.

…1-44906 fix: minimist: prototype pollution

…20165) - Added explicit debug@^3.1.0 dependency to override transitive dependencies pinning debug@2.2.0 - This addresses the ReDoS vulnerability in the useColors function identified in CVE-2017-20165 - The 3.1.0 version provides a safe regex pattern without breaking changes - Regenerated package-lock.json to reflect the new dependency constraints

…VE-2022-21681 This commit patches the Regular Expression Denial of Service (ReDoS) vulnerability in marked's inline.reflinkSearch regex pattern (CVE-2022-21681). Changes: - Upgraded marked dependency from 0.3.5 to 4.0.10 - Removed deprecated sanitize option from marked.setOptions() call - Updated package-lock.json with new dependency versions The vulnerability allowed catastrophic backtracking against certain markdown patterns, potentially leading to DoS. Version 4.0.10 includes the fix. Note: The sanitize option is no longer available in marked@4.x. HTML sanitization is no longer built-in. Consider using DOMPurify or similar on the frontend for additional security if displaying user-generated markdown.

- Add template path validation to prevent directory traversal attacks - Restrict include/extends tags to files within app/views directory - Document upstream vulnerability (swig@1.4.2 has no patched version available) - Implement interim mitigation until migration to maintained template engine Fixes CVE-2023-25345: Arbitrary local file read via template includes/extends Related: https://nvd.nist.gov/vuln/detail/CVE-2023-25345

…21681 fix: upgrade marked from 0.3.5 to 4.0.10 to fix ReDoS vulnerability CVE-2022-21681

…023-25345 fix: Mitigate CVE-2023-25345 directory traversal in swig template engine

…2017-20165 fix: upgrade debug to 3.1.0 to address ReDoS vulnerability (CVE-2017-20165)

- Removed artifacts/cert/server.key from entire git history using BFG Repo-Cleaner - Updated .gitignore to prevent future commits of certificate/key files - All 938 affected objects rewritten to remove private key material - Private key no longer accessible via git history

+    name: Node.js
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ["10.x", "12.x", "14.x"]
+
+    steps:
+      - name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/.npm
+            ~/.cache
+          key: ${{ runner.os }}-node${{ matrix.node-version }}-E2E-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        run: |
+          npm ci
+          npm run cy:verify
+
+      - name: Start MongoDB
+        run: |
+          docker run -d -p 27017:27017 mongo:4.0
+          timeout 60s bash -c 'until nc -z -w 2 localhost 27017 && echo MongoDB ready; do sleep 2; done'
+
+      - name: Run E2E test suite
+        id: test-suite
+        run: |
+          NODE_ENV=test npm start -- --silent &
+          npm run test:ci -- --config video=true
+
+      - name: Prepare cypress artifacts
+        if: failure() && (steps.test-suite.outcome == 'failure')
+        working-directory: ./test/e2e
+        run: >
+          mkdir -p "screenshots" && find "screenshots" -mindepth 1 -maxdepth 1 -type d
+          -exec sh -c 'mv -- "videos/$(basename "$1").mp4" "$1"' _ {} \;
+
+      - name: Upload cypress artifacts
+        if: failure() && (steps.test-suite.outcome == 'failure')
+        uses: actions/upload-artifact@v2
+        with:
+          name: cypress-artifacts-node${{ matrix.node-version }}
+          path: test/e2e/screenshots


+    name: Node.js
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ["14.x"]
+
+    steps:
+      - name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Run linter
+        run: npx --no-install jshint@2.12.0 .


+                throw `The user supplied threshold: ${parsedThreshold} was not valid.`;
+                */
+                return {
+                    $where: `this.userId == ${parsedUserId} && this.stocks > '${threshold}'`


+        usersCol.findOne({
+            userName: userName
+        }, validateUserDoc);


+        usersCol.findOne({
+            userName: userName
+        }, callback);


+
+        /*jslint evil: true */
+        // Insecure use of eval() to parse inputs
+        const preTax = eval(req.body.preTax);


+        /*jslint evil: true */
+        // Insecure use of eval() to parse inputs
+        const preTax = eval(req.body.preTax);
+        const afterTax = eval(req.body.afterTax);


+        // const regexPattern = /([0-9]+)\#/;
+        const regexPattern = /([0-9]+)+\#/;
+        // Allow only numbers with a suffix of the letter #, for example: 'XXXXXX#'
+        const testComplyWithRequirements = regexPattern.test(bankRouting);


+            return needle.get(url, (error, newResponse, body) => {
+                if (!error && newResponse.statusCode === 200) {
+                    res.writeHead(200, {
+                        "Content-Type": "text/html"
+                    });
+                }
+                res.write("<h1>The following is the stock information you requested.</h1>\n\n");
+                res.write("\n\n");
+                if (body) {
+                    res.write(body);
+                }
+                return res.end();
+            });


+            return false;
+        }
+        if (email !== "") {
+            if (!EMAIL_RE.test(email)) {


+    app.use(session({
+        // genid: (req) => {
+        //    return genuuid() // use UUIDs for session IDs
+        //},
+        secret: cookieSecret,
+        // Both mandatory in Express v4
+        saveUninitialized: true,
+        resave: true,
+        /*
+        // Fix for A5 - Security MisConfig
+        // Use generic cookie name
+        key: "sessionId",
+        */
+
+        // Fix for A3 - XSS and session hijacking prevention
+        // TODO: Add "maxAge"
+        cookie: {
+            httpOnly: true,
+            // Remember to start an HTTPS server to get this working
+            secure: true
+        }
+
+    }));


+    }
+
+    // Safe to redirect
+    return res.redirect(validation.url);


jboyer2012 and others added 30 commits September 25, 2017 21:13

Update a6 to to follow Node.js best practices for crypto library.

5aa369f

Merge pull request #1 from OWASP/master

3521414

Updating my fork with latest from OWASP master

Update string quotes for project style guide.

270c17e

Merge branch 'master' of https://github.com/jboyer2012/NodeGoat

587f442

Add missing semicolon

c689af4

Merge pull request OWASP#104 from jboyer2012/master

c69760d

Update tutorial and comments for A6 to match Node.js best practices

feat(injection): log injection example

6c28712

feat(session): improper session management

68cc71a

feat(log-injection): adding a log injection example

9b9f4c9

feat(log-injection): add tutorial description

dc4293c

feat(session): add tutorial documentation

bfea140

fix(docs): CSRF -> CRLF

69c6d55

Update a4.html

f4731a9

Remove extraneous word "access"

Update a8.html

3c97398

grammatical fixes

Merge pull request OWASP#111 from joebowbeer/patch-2

26c82bf

Update a8.html

Merge pull request OWASP#110 from joebowbeer/patch-1

6cc5017

Update a4.html

Merge pull request OWASP#107 from lirantal/feat/session-fixation

9e5431e

feat(session): improper session management

Merge pull request OWASP#108 from lirantal/feat/log-injection

4a82f87

feat(log-injection): example vulnerable code for CSRF injection

Fix comment

78cbef2

Fix insecure dependency

450017b

close#112

3d58bdc

Updated MongoLab url to mLab

Minor Updates

befeee7

feat(xss-context): add example for context sensitive XSS encoding issues

843700d

fix: use the actual encoded string in the view template

2d8e2b2

feat(xss-context): add example for context sensitive XSS encoding iss…

95c16db

…ues (OWASP#115)

feat(xss-context): improve comments and add tutorial section

d7aed4d

Merge pull request OWASP#116 from lirantal/feat/xss-context-aware-tut…

e808f3c

…orial feat(xss-context): improve comments and add tutorial section

Proof of Concept SSRF Vulnerability in Research Feature

0a4f186

change app.csp() with contentSecurityPolicy()

e812191

Added SSRF Tutorial

6e47500

galanko and others added 28 commits May 15, 2026 13:07

Merge pull request #1 from cliff-security/opensec/fix/express-cve-202…

b92d520

…4-29041 fix: express: cause malformed URLs to be evaluated

Merge pull request #2 from cliff-security/opensec/fix/underscore-cve-…

4802150

…2021-23358 fix: nodejs-underscore: Arbitrary code execution via the template function

Merge pull request #3 from cliff-security/opensec/fix/open-redirect-v…

ef69f3d

…alidation fix: Prevent open redirect vulnerability in /learn endpoint

Merge pull request #4 from cliff-security/opensec/fix/mixin-deep-cve-…

119ce63

…2019-10746 fix: nodejs-mixin-deep: prototype pollution in function mixin-deep

Merge pull request #5 from cliff-security/opensec/fix/bson-cve-2020-7610

cb0213f

fix: bson: Deserialization of Untrusted Data vulnerability CVE-2020-7610

Merge pull request #7 from cliff-security/opensec/fix/set-value-cve-2…

ff444b6

…019-10747 fix: nodejs-set-value: prototype pollution in function set-value

Merge pull request #11 from cliff-security/opensec/fix/utile-0-3-0-ns…

ab23093

…wg-eco-445 fix: Out-of-bounds Read

Merge pull request #13 from cliff-security/opensec/fix/helmet-csp-GHS…

5c714c7

…A-c3m8-x3cg-qm2c fix: Configuration Override in helmet-csp

Merge pull request #15 from cliff-security/opensec/fix/on-headers-cve…

97c2f68

…-2025-7339 fix: upgrade on-headers to 1.1.0 - Address CVE-2025-7339

Merge pull request #17 from cliff-security/opensec/fix/decode-uri-com…

4b9f605

…ponent-cve-2022-38900 fix: decode-uri-component: improper input validation resulting in DoS

Merge pull request #22 from cliff-security/opensec/fix/express-sessio…

7dd0bc6

…n-secure fix: Add secure flag to session middleware cookie configuration

ci: add Dependabot config (OpenSec posture PR)

8e2e2e3

docs: add SECURITY.md (OpenSec posture PR)

a6d61f3

Merge pull request #23 from cliff-security/opensec/posture/dependabot

e626e15

ci: add Dependabot config

Merge pull request #24 from cliff-security/opensec/posture/security-md

e1627e9

docs: add SECURITY.md

security: upgrade fsevents from 1.2.9 to 1.2.13 (CVE-2023-45311)

a1e9119

Merge pull request #6 from cliff-security/opensec/fix/fsevents-cve-20…

c4eeadc

…23-45311 security: upgrade fsevents from 1.2.9 to 1.2.13 (CVE-2023-45311)

Merge pull request #36 from cliff-security/cliff/fix/minimist-cve-202…

c00184e

…1-44906 fix: minimist: prototype pollution

Merge pull request #38 from cliff-security/cliff/fix/marked-cve-2022-…

491cd85

…21681 fix: upgrade marked from 0.3.5 to 4.0.10 to fix ReDoS vulnerability CVE-2022-21681

Merge pull request #39 from cliff-security/cliff/fix/swig-1.4.2-cve-2…

4c50ca5

…023-25345 fix: Mitigate CVE-2023-25345 directory traversal in swig template engine

Merge pull request #37 from cliff-security/cliff/fix/debug-2.2.0-cve-…

d28c24e

…2017-20165 fix: upgrade debug to 3.1.0 to address ReDoS vulnerability (CVE-2017-20165)

github-advanced-security AI found potential problems May 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Asymmetric Private Key#41

fix: Asymmetric Private Key#41
galanko wants to merge 486 commits into
masterfrom
cliff/fix/private-key-exposure-v2

galanko commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

galanko commented May 18, 2026

Summary

Vulnerability Details

Changes Made

Security Impact

Before Remediation

After Remediation

Verification

Follow-up Actions Required

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants