morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

In morgan, the :remote-user token is populated from the HTTP Authorization: Basic ... header via the basic-auth package, and the current upstream source returns the decoded username directly into the log line without neutralizing control characters. Because the standard default, combined, common, and short formats all include :remote-user, an attacker who can send a request can base64-encode a username containing newline or other control characters and poison line-oriented logs. *Inference from public source code:* the latest public release is 1.10.1, and the current public source still shows the unsafe pattern, so the safest external assessment is that public releases through 1.10.1 are affected unless the operator has locally sanitized or removed :remote-user.

The vendor's MEDIUM 5.3 is defensible in a vacuum because the bug is remotely reachable and changes integrity, but it still overshoots enterprise patch urgency. This is not initial access, not auth bypass, and not code execution; it's audit-trail corruption whose real damage depends on whether you use a vulnerable log format, trust those logs operationally, and have downstream systems that treat a forged line as truth. For a 10,000-host program, that's *backlog hygiene with some SOC-facing compensations*, not a front-of-queue fire.

Why this verdict

• Dropped from the 5.3 vendor baseline because the effect is post-request log poisoning, not attacker progression — no foothold expansion, no session theft, no code execution.
• Real deployment exposure is narrower than AV:N suggests — only apps running Morgan *and* using a format containing :remote-user are affected; dev and tiny are not hit by this exact path.
• No active exploitation signal — no KEV listing, no public campaign reporting, and no public exploit ecosystem beyond trivial manual reproduction.

Why not higher?

An unauthenticated remote attacker can reach the vulnerable code path, but the consequence is forged log content, not direct system compromise. To get from 'poisoned access log' to 'material enterprise damage,' you need additional assumptions about analyst trust, downstream parser weakness, or brittle automation.

Why not lower?

This still matters because the unsafe token is present in several standard Morgan formats, and attackers do not need the app to actually authenticate them with Basic auth to influence :remote-user. If your access logs feed investigations, detections, or compliance evidence, forged lines are a real integrity problem.

1. Remove :remote-user from Morgan formats — If you cannot patch or upstream has not shipped a fix, switch default/combined/common/short to a custom format that omits :remote-user. For a LOW verdict there is no SLA; treat this as backlog hygiene and make the change during normal application maintenance.
2. Sanitize log fields before write — Neutralize CR, LF, tabs, and ANSI/control bytes in any user-derived token before writing to stdout or files. For this LOW issue, implement during normal logger hardening rather than emergency change windows.
3. Prefer structured logging — Move access telemetry into JSON with proper field encoding, then let the shipper serialize records instead of concatenating line-oriented strings. This is the best long-term control for CWE-117 style bugs and fits backlog-hygiene timing.
4. Alert on control characters in access logs — Add a SIEM or log-pipeline rule to flag usernames or request fields containing non-printable bytes, line breaks, or escape sequences. There is no emergency deadline here, but it is a cheap detective control for shared Express logging patterns.

Run this on the application host, CI workspace, or source checkout that contains the Node project. Invoke it with python3 check_morgan_cve_2026_5078.py /path/to/app using any account that can read the project files; no admin rights are required.

#!/usr/bin/env python3
"""
check_morgan_cve_2026_5078.py

Detect likely exposure to CVE-2026-5078 in the Node.js `morgan` package.

Usage:
  python3 check_morgan_cve_2026_5078.py /path/to/app

Exit codes:
  0 = PATCHED / not affected
  1 = VULNERABLE
  2 = UNKNOWN / insufficient evidence
"""

import json
import os
import re
import sys
from typing import List, Tuple

FIXED_VERSION = None  # No public fixed version was located during assessment


def parse_semver(v: str):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def find_morgan_paths(root: str) -> List[str]:
    hits = []
    for dirpath, dirnames, filenames in os.walk(root):
        if os.path.basename(dirpath) == 'morgan':
            pkg = os.path.join(dirpath, 'package.json')
            idx = os.path.join(dirpath, 'index.js')
            if os.path.isfile(pkg) and os.path.isfile(idx):
                hits.append(dirpath)
    return sorted(set(hits))


def load_pkg_version(pkg_json: str):
    try:
        with open(pkg_json, 'r', encoding='utf-8') as f:
            data = json.load(f)
        return data.get('version')
    except Exception:
        return None


def source_looks_vulnerable(index_js: str) -> bool:
    try:
        with open(index_js, 'r', encoding='utf-8', errors='replace') as f:
            src = f.read()
    except Exception:
        return False

    token_present = "morgan.token('remote-user'" in src or 'morgan.token("remote-user"' in src
    unsafe_return = 'return credentials ? credentials.name : undefined' in src
    sanitize_markers = [
        'replace(/\\r/g',
        'replace(/\\n/g',
        'replace(/[\\r\\n]/g',
        'replace(/[\\x00-\\x1f\\x7f]/g',
        'sanitize',
        'escape'
    ]
    sanitization_obvious = any(marker in src for marker in sanitize_markers)
    return token_present and unsafe_return and not sanitization_obvious


def assess_one(path: str) -> Tuple[str, str]:
    pkg = os.path.join(path, 'package.json')
    idx = os.path.join(path, 'index.js')
    version = load_pkg_version(pkg)
    looks_vuln = source_looks_vulnerable(idx)

    if looks_vuln:
        return ('VULNERABLE', f'{path} version={version or "unknown"} source pattern matches unsanitized :remote-user token')

    if version and FIXED_VERSION:
        pv = parse_semver(version)
        fv = parse_semver(FIXED_VERSION)
        if pv and fv and pv >= fv:
            return ('PATCHED', f'{path} version={version} >= fixed version {FIXED_VERSION}')

    if version and not looks_vuln:
        return ('UNKNOWN', f'{path} version={version} found, but source did not clearly match the known vulnerable pattern and no public fixed version is available')

    return ('UNKNOWN', f'{path} found, but version/source inspection was inconclusive')


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_morgan_cve_2026_5078.py /path/to/app')
        sys.exit(2)

    root = os.path.abspath(sys.argv[1])
    if not os.path.exists(root):
        print(f'UNKNOWN - path does not exist: {root}')
        sys.exit(2)

    paths = find_morgan_paths(root)
    if not paths:
        print('PATCHED - morgan package not found under the supplied path')
        sys.exit(0)

    results = [assess_one(p) for p in paths]
    for status, detail in results:
        print(f'{status} - {detail}')

    statuses = [s for s, _ in results]
    if 'VULNERABLE' in statuses:
        print('VULNERABLE')
        sys.exit(1)
    if all(s == 'PATCHED' for s in statuses):
        print('PATCHED')
        sys.exit(0)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. expressjs/morgan repository and README
2. morgan current source (`index.js`)
3. morgan latest public release 1.10.1
4. Snyk package versions for morgan
5. basic-auth source on UNPKG
6. CISA Known Exploited Vulnerabilities Catalog
7. MITRE CAPEC log forging pattern