Skip to content

v1.1.0.md

Latest commit

 

History

History
343 lines (276 loc) · 14.8 KB

v1.1.0.md

File metadata and controls

343 lines (276 loc) · 14.8 KB

Release Notes - v1.1.0

Release Date: 2025-12-13 Type: Security and Compatibility Release

Summary

This release focuses on comprehensive security hardening and Node.js 22 compatibility improvements for the CyberChef MCP Server. We've addressed 11 security vulnerabilities (5 code scanning issues + 2 dependency vulnerabilities + 4 additional fixes), enhanced password hashing standards, and significantly improved project documentation organization.

Security Improvements (CRITICAL)

Code Scanning Fixes (5 issues)

1. CWE-116: Incomplete String Escaping in Utils.mjs

  • File: src/core/Utils.mjs (Line 1024)
  • Issue: Incomplete sanitization when processing recipe arguments could allow injection attacks
  • Fix: Implemented proper two-step escaping pattern:
    1. Escape backslashes first: replace(/\\/g, "\\\\")
    2. Escape quotes second: replace(/"/g, '\\"')
  • Impact: Prevents injection attacks via recipe argument manipulation

2. CWE-116: Incomplete String Escaping in PHPDeserialize.mjs

  • File: src/core/operations/PHPDeserialize.mjs (Line 154)
  • Issue: Incomplete sanitization when deserializing PHP strings in "true JSON" mode
  • Fix: Applied two-step escaping process for backslashes and quotes
  • Impact: Prevents injection during PHP deserialization

3. CWE-116: Incomplete String Escaping in JSONBeautify.mjs

  • File: src/core/operations/JSONBeautify.mjs (Line 165)
  • Issue: Incomplete escaping in HTML-formatted JSON output
  • Fix: Proper two-step escape for JSON display in HTML
    1. Escape backslashes: replace(/\\/g, "\\\\")
    2. Escape HTML entities: replace(/"/g, "\\"")
  • Impact: Prevents XSS when rendering JSON strings as HTML

4. CWE-79: Cross-Site Scripting (XSS) in BindingsWaiter.mjs

  • File: src/web/waiters/BindingsWaiter.mjs (Lines 295, 298)
  • Issue: Direct innerHTML assignment of user-controlled help text
  • Fix: Replaced innerHTML with safe DOM API methods:
    • Use textContent for setting text safely
    • Create elements programmatically with createElement()
    • Build DOM tree without parsing untrusted HTML
  • Impact: Prevents XSS attacks via malicious help text attributes

5. CWE-916: Insufficient Password Hash Iterations in DeriveEVPKey.mjs

  • File: src/core/operations/DeriveEVPKey.mjs (Lines 73-74, 125)
  • Issue: Default iteration count insufficient for secure key derivation
  • Fix: Multi-layered security improvements:
    • Increased default iterations from 1 → 10,000 (NIST SP 800-132 recommended minimum)
    • Enforce runtime minimum of 10,000 iterations (raised from 1,000)
    • Added validation with Math.max(iterations, minIterations)
    • Fixed OpenSSL KDF to explicitly set iterations: 10000 (was defaulting to 1)
    • Added user warnings for low iteration counts
  • Impact: Protects against brute-force attacks on derived keys
  • Compliance: NIST SP 800-63B compliant for PBKDF2

Dependency Vulnerabilities (2 issues)

6. CVE-2024-55565: babel-plugin-transform-builtin-extend Prototype Pollution

  • Severity: High (7.3 CVSS)
  • Package: babel-plugin-transform-builtin-extend@1.1.2
  • Fix: Removed deprecated package entirely
    • Deleted from package.json devDependencies
    • Removed from babel.config.js plugins array
    • Modern Babel natively supports extending built-ins (Error class)
  • Impact: Eliminates prototype pollution attack vector

7. GHSA-64g7-mvw6-v9qj: shelljs Command Injection

  • Severity: High (9.8 CVSS)
  • Package: shelljs@<0.8.5 (transitive dependency)
  • Fix: Added npm override "shelljs": ">=0.8.5" in package.json
  • Impact: Forces all dependency chains to use patched shelljs version

Additional Dependency Security (4 fixes via npm audit)

8. @babel/helpers & @babel/runtime RegExp Complexity

  • Severity: Moderate
  • Fix: Updated to 7.28.4 (from 7.24.x)
  • Issue: Complex regular expressions could cause ReDoS

9. @eslint/plugin-kit ReDoS Vulnerability

  • Severity: Low
  • Fix: Updated to 0.4.1
  • Indirect: Also updated eslint to 9.39.1

10. @modelcontextprotocol/sdk DNS Rebinding

  • Severity: High
  • Fix: Updated to 1.24.3 (from 1.22.0)
  • Issue: Potential DNS rebinding attack vector

11. body-parser DoS & brace-expansion ReDoS

  • Severity: Moderate
  • Fix: Updated body-parser to 2.2.1, brace-expansion to 1.1.12/2.0.2

Security Metrics

  • Total Vulnerabilities Fixed: 11 (5 code scanning + 2 dependency + 4 audit fixes)
  • Vulnerability Reduction: 76% (16 of 21 vulnerabilities addressed when combined with previous fixes)
  • Remaining Issues: 5 (all in development dependencies only, not affecting MCP server runtime)
  • Production MCP Server Risk: Low

Node.js 22 Compatibility

serialize-javascript Patch (Critical Build Fix)

  • Issue: serialize-javascript@7.0.2 uses crypto.getRandomValues() without checking if crypto global is available
  • Error: ReferenceError: crypto is not defined in Node.js 22+
  • Fix: Created automated patch script (scripts/fix-serialize-javascript.js)
    • Detects environment (browser vs Node.js)
    • Browser: Uses crypto.getRandomValues() (Web Crypto API)
    • Node.js: Uses require('crypto').randomBytes() (Node.js crypto module)
    • Idempotent: Checks if already patched before applying changes
  • Integration: Added to postinstall hook chain and Gruntfile exec tasks
  • Impact: Fixes CI lint workflow failures, ensures clean Node.js 22+ builds

SlowBuffer Deprecation

  • Files Affected: node_modules/avsc/lib/types.js, node_modules/buffer-equal-constant-time/index.js
  • Fix: Automated patches in Dockerfile.mcp
    • new SlowBuffer → Buffer.alloc
    • SlowBuffer → Buffer
  • Status: Already implemented in v1.0.0, maintained in v1.1.0

JSON Import Syntax

  • Change: Updated all JSON imports to modern syntax
  • Format: import ... with {type: "json"} (Node.js 22+ standard)
  • Status: Already implemented in v1.0.0, maintained in v1.1.0

Test Updates

  • File: tests/node/tests/operations.mjs
  • Change: Updated "Derive EVP Key" test expected output
    • Old: 4930d5d200e80f18c96b5550d13c6af8 (1,000 iterations)
    • New: 59f6933e20bbddbbbab1d679752b8337 (10,000 iterations)
  • Reason: Security fix increased minimum iterations from 1,000 to 10,000

Distribution Improvements

Docker Image Tarball Distribution (NEW)

  • Offline Installation: Pre-built Docker images now available as downloadable tarballs (~270MB compressed)
  • Automated Workflow: mcp-release.yml automatically exports and attaches Docker images to GitHub Releases
  • Use Case: Enables installation in air-gapped environments or networks without GHCR access
  • Usage: 
    # Download tarball from GitHub Releases
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.1.0/cyberchef-mcp-v1.1.0-docker-image.tar.gz

# Load into Docker
docker load < cyberchef-mcp-v1.1.0-docker-image.tar.gz

# Run the server
docker run -i --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.1.0
  • Workflow Enhancement: Release workflow now includes:
    • Pull pushed image from GHCR
    • Export as compressed tarball (docker save | gzip)
    • Attach to GitHub Release as downloadable asset
    • Automatic execution on all future v* tags

Documentation Improvements

Directory Reorganization

  • Created docs/planning/:

    • Moved to-dos/roadmap.md → docs/planning/roadmap.md
    • Moved to-dos/tasks.md → docs/planning/tasks.md

  • Created docs/releases/:

    • Moved RELEASE_NOTES.md → docs/releases/v1.0.0.md
    • Added docs/releases/v1.1.0.md (this file)

  • Created docs/security/:

    • Moved SECURITY_AUDIT.md → docs/security/audit.md
    • Added .github/SECURITY_MAINTENANCE.md (ongoing maintenance guide)

  • Cleanup:

    • Deleted GEMINI.md (consolidated into CLAUDE.md and .github/copilot-instructions.md)

Enhanced README.md

  • Badges: Added Node.js version badge (>=22), Docker badge
  • Quick Start: Added GHCR pull option (recommended), improved build instructions
  • Offline Installation: New Option 2 with detailed tarball download and loading instructions
  • Client Configuration: Added Claude Desktop section with platform-specific config paths
  • Security Section: New comprehensive security section with metrics and risk assessment
  • Documentation Organization: Categorized into User, Technical, Project Management, Security
  • CI/CD Details: Added workflow links and descriptions
  • Repository Information: Links to GHCR, issues, original CyberChef

Enhanced CHANGELOG.md

  • Format: Adopted Keep a Changelog format
  • Structure: Clear version sections with dates
  • Categories: Added, Changed, Fixed, Security, Removed
  • Compliance: Follows Semantic Versioning

Project Guidance Files

  • Added CLAUDE.md: Comprehensive Claude Code AI assistant integration guide

    • Architecture overview (MCP server, Node API, CyberChef core)
    • Essential commands (setup, run, development, testing)
    • Common issues and solutions
    • Documentation structure
    • Code conventions

  • Added .github/copilot-instructions.md: GitHub Copilot custom instructions

  • Added .github/SECURITY_MAINTENANCE.md: Ongoing security maintenance procedures

CI/CD Improvements

Fixed Workflows

  • core-ci.yml: Fixed lint failures caused by serialize-javascript patch
  • All Workflows Verified: 5 GitHub Actions workflows confirmed passing
    • Core CI (lint + tests on Node.js 22)
    • MCP Docker Build
    • MCP Release (GHCR publishing)
    • CodeQL Analysis
    • Pull Request Checks

Test Suite Status

  • Node API Tests: 217/217 passing
  • Operation Tests: 1,716/1,716 passing
  • Node Consumer Tests: CJS and ESM both passing
  • All CI Checks: Passing

Breaking Changes

DeriveEVPKey Minimum Iterations

  • Previous: Minimum 1,000 iterations (enforced at runtime)
  • New: Minimum 10,000 iterations (enforced at runtime)
  • Impact: Users specifying <10,000 iterations will receive secure minimum with warning
  • Rationale: NIST SP 800-63B compliance for PBKDF2
  • Migration: Update recipes using DeriveEVPKey with low iteration counts

Technical Details

Commits Included (22 commits since v1.0.0)

5f4a9acc ci(release): Add Docker image tarball export and release attachment
4c14223c release(v1.1.0): Security hardening, Node.js 22 compatibility, and documentation overhaul
72ab48ea docs: Comprehensive README and CHANGELOG update
57a29ad0 fix(build): Fix Node.js 22 compatibility for serialize-javascript
bc8ed633 fix(security): Strengthen password hash iteration enforcement
b4032efd refactor(security): Comprehensive security fixes and docs reorganization
b5f3d27c chore(project): Add Claude Code project guidance
ff78b6d3 Clarify babel-traverse vulnerability count
6b9e27c1 Add comprehensive security maintenance guide
b2b61c58 Improve SECURITY_AUDIT.md documentation accuracy
b0ff2b3e Fix SECURITY_AUDIT.md clarity on vulnerability counts
8eccf963 Phase 3: Document remaining vulnerabilities
7a6cc4d9 Phase 2: Fix additional vulnerabilities with overrides
03a7ed8b Phase 1: Apply safe automatic security fixes
2bb86484 Initial plan (security audit)
baab0973 Bump npm_and_yarn group (Dependabot)
a9ef985c Fix JWT and JPath test failures
5e04c36e Initial plan (test fixes)
fbaed2da Fix JWT and JPath test failures
ee1b6e8f Add GitHub Copilot custom instructions
b797b79e Initial plan (Copilot setup)
0fb21f8e Bump node-forge to 1.3.2 (Dependabot)

Files Changed Statistics

  • 17 files modified in comprehensive security fix commit
  • 281 lines changed in package-lock.json (dependency updates)
  • 56 lines added for serialize-javascript patch script
  • 300+ lines added for security maintenance guide
  • 238 lines added for security audit documentation

String Escaping Pattern (Security Critical)

All escaping fixes follow the critical two-step pattern:

  1. Escape backslashes first: \ → \\
  2. Escape quotes/special chars second: " → \"

Why this order matters: Prevents bypass attacks where \" could become \\" + " (escaped backslash + unescaped quote)

Password Hashing Improvements

  • Standard: NIST SP 800-132 compliance (10,000+ iterations for PBKDF2)
  • Enforcement: Runtime validation with Math.max(iterations, minIterations)
  • User Experience: Warnings for insecure configurations
  • Backward Compatibility: Higher iteration counts work unchanged

Migration Notes

For Users

  1. DeriveEVPKey Operation: If using <10,000 iterations, update recipes to use at least 10,000
  2. Docker Image: Pull latest from GHCR: docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest
  3. No Client Changes Required: MCP protocol unchanged

For Developers

  1. npm install: Will automatically apply all patches via postinstall hooks
  2. Node.js 22+ Required: Ensure Node.js >=22 installed
  3. Test Suite: Run npm test to verify all 1,933 tests pass
  4. Documentation: Review new docs structure in docs/ directory

Known Issues

Remaining Vulnerabilities (5 total)

All remaining issues are in development dependencies only and do not affect the production MCP server runtime:

  1. babel-traverse@6.26.0 (3 critical)

    • GHSA-67hx-6x53-jw92 (Arbitrary Code Execution)
    • Affects legacy Babel 6 plugin, no fix available
    • Used only in development build process

  2. shelljs@0.8.1 (2 high)

    • GHSA-4rq4-32rv-6wp6, GHSA-64g7-mvw6-v9qj
    • Used only for build artifact permissions (chmod)
    • Override forces >=0.8.5 where possible, but some dependencies locked to 0.8.1

Risk Assessment: Production MCP server runtime is Low Risk

Upgrade Instructions

Docker (Recommended)

# Pull latest pre-built image
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

# Or build from source
git pull origin master
docker build -f Dockerfile.mcp -t cyberchef-mcp .

Local Development

git pull origin master
npm install  # Applies all patches automatically
npx grunt configTests
npm test

Contributors

  • DoubleGate (@parobek)
  • Claude Opus 4.5 (AI pair programming assistant)
  • Dependabot (Automated dependency updates)
  • GitHub Copilot (Code suggestions and documentation)

Links

Full Changelog: v1.0.0...v1.1.0