If an attacker can write to Redis, they can achieve arbitrary code execution via crafted pickle payloads. Metadata keys are predictable (metadata:{imageId}:{metaName}).
Impact: Full server compromise
Prerequisite: Write access to Redis (no auth visible in code)
Recommendation: Replace pickle.loads() with json.loads() or use pickle.loads() with a restricted unpickler
2. Command Injection in Janus exec()
CRITICAL: Command Injection
Files:
vuer_oss/server/convert/JanusConvertProcess.js:52
vuer_oss/server/convert/JanusMetaProcess.js:35
Both use exec() with template literal string interpolation:
If flags, inputFile, or outputFile contain shell metacharacters (;, |, `, $()), this enables command injection. Inputs likely come from media file paths (system-generated), but a crafted filename could exploit this.
Impact: Arbitrary command execution on server
Recommendation: Replace exec() with execFile('janus-pp-rec', [flags, inputFile, outputFile])
When config.settings.allowSelfSignedCerts is true, ALL TLS certificate validation is disabled globally. The dev config enables this. If accidentally left on in production, MITM attacks become trivial.
logger.warn(`JWT Token authentication failed for token: '${jwtToken}'`, err)
Logs the raw encrypted JWT token on auth failure. Could aid an attacker with log access.
Recommendation: Log token hash or first/last characters only.
10. CORS Mutation Race Condition
MEDIUM: CORS Configuration Race
File: vuer_css/server/web/routes.js:203-215
WebSDK CORS handler mutates shared corsOptions.origin object based on Referer header. Under concurrent requests, one request’s CORS origin could leak to another.
11. Session Scanning DoS Vector
MEDIUM: Denial of Service
File: vuer_oss/server/web/session.js:4-17
listSessions() loads ALL sessions into memory and parses JSON to find a user’s sessions. O(n) scan with no index. Could be a DoS vector if many sessions exist.
12. Weak PBKDF2 (5000 iterations)
MEDIUM: Weak Key Derivation
File: vuer_oss/server/gcm.js and esign_oss/server/gcm.js
AES-256-GCM key derivation uses only 5000 PBKDF2 iterations. Modern recommendations (OWASP) suggest 600,000+ for SHA-256.
13. Unencrypted Redis
MEDIUM: Unencrypted Data Store
All vuer_cv image data, metadata, and RPC communication goes through Redis with no visible encryption or authentication in code (depends on config). Redis as single point of failure.
Both vuer_css and esign use the csurf package which is deprecated and has known issues.
16. CSP Bypassed for IE/Safari
LOW: CSP Bypass
File: vuer_css/server/web/WebServer.js:162
CSP middleware completely skipped for Internet Explorer and Safari browsers.
17. Password Over RabbitMQ
LOW: Plaintext Credentials in Transit
Customer passwords travel in plaintext over RabbitMQ RPC (esign_css → esign_oss). The RabbitMQ connection is TLS-encrypted (AMQPS), which mitigates this.
18. Hardcoded Test Password
LOW: Hardcoded Credential
File: vuer_oss/server.js:290-292
In test mode, PasswordService.generateTemporaryPassword() returns the hardcoded string 'temppassword' for all temporary passwords. If test mode is accidentally enabled in production, all temp passwords become guessable.
19. Config.get() Falsy Bug
LOW: Logic Bug
config.get() in both vuer_css and esign treats 0 and '' as missing values due to !current[path[0]] check. Could cause unexpected behavior with valid falsy config values.
Positive Security Findings
Security Strengths
The codebase demonstrates many strong security practices:
Practice
Details
No eval()
No eval(), Function(), or dynamic code execution in Node.js code
No raw SQL
Consistent Sequelize ORM usage; no SQL injection vectors found
Helmet.js
Comprehensive HTTP security headers on all Express apps
CSRF protection
csurf middleware with secure, httpOnly, sameSite=strict cookies
Rate limiting
RateLimiterService with configurable throttle, cooldown, and attempt limits
Multi-factor auth
TOTP + WebAuthn/FIDO2 support
JWE encryption
JWT tokens encrypted before transmission
Encryption at rest
Per-domain crypto services for media, certs, attachments, data
Audit logging
50+ event types logged to AuditLog table
Trusted timestamps
RFC 3161 timestamping for legal compliance
Session-level ACL
Fine-grained access control beyond role-based
Host header validation
Blocks requests with unexpected Host headers
Config masking
getSecureConfig() properly masks sensitive fields for logging