PT-2017-10978 · Unknown · Typed-Function

Masato Kinugawa · Publicado 2017-11-27 · Atualizado 2020-09-02 · CVE-2017-1001004

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions typed-function versions prior to 0.10.6

Description The issue allows for arbitrary code execution in the JavaScript engine. This can occur when creating a typed function with JavaScript code in the name, potentially leading to arbitrary execution. The problem stems from improper sanitization of function names, which may enable an attacker to execute arbitrary code.

Recommendations For versions prior to 0.10.6, upgrade to version 0.10.6 or later.

Correção

Code Injection

RCE

Enumeração de Fraquezas

CWE-94

CWE-20

Identificadores relacionados

CVE-2017-1001004

GHSA-3QH4-R86R-GRVM

Produtos afetados

Typed-Function

Referências · 8

• https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe · Nota
• https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8 · Nota
• https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1001004 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1001004 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3qh4-r86r-grvm · Aviso do Fabricante
• https://npmjs.com/advisories/819 · Nota
• https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139 · Nota