PT-2017-4099 · Microsoft · Uglify-Js

Publicado 2017-01-23 · Atualizado 2021-10-28 · CVE-2015-8857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uglify-js versions prior to 2.4.24

Description The issue is related to errors in input syntax checking in the uglify-js library, which may allow a remote attacker to execute arbitrary code using a specially crafted JavaScript. The vulnerability is caused by the library not properly accounting for non-boolean values when rewriting boolean expressions, potentially allowing attackers to bypass security mechanisms. This may have an unspecified impact by leveraging improperly rewritten JavaScript. Crafted JavaScript may have altered functionality after minification.

Recommendations Upgrade UglifyJS to version >= 2.4.24.

Exploit

Correção

Eval Injection

Enumeração de Fraquezas

CWE-254

CWE-1254

CWE-95

CWE-670

Identificadores relacionados

BDU:2021-02856

CVE-2015-8857

GHSA-34R7-Q49F-H37C

GHSA-G6F4-J6C2-W3P3

Produtos afetados

Uglify-Js

Referências · 23

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml · Exploit
• 🔥 https://nodesecurity.io/advisories/39 · Exploit
• https://github.com/mishoo/UglifyJS2 · Nota
• https://github.com/mishoo/UglifyJS2/issues/751 · Nota
• https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e · Nota
• https://osv.dev/vulnerability/CVE-2015-8857 · Aviso do Fabricante
• https://web.archive.org/web/20200227190830/http://securityfocus.com/bid/96410 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8857 · Nota de Segurança
• https://zyan.scripts.mit.edu/blog/backdooring-js · Nota
• https://osv.dev/vulnerability/GHSA-g6f4-j6c2-w3p3 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8857 · Nota de Segurança
• https://openwall.com/lists/oss-security/2016/04/20/11 · Nota
• https://ubuntu.com/security/CVE-2015-8857 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8857 · Aviso do Fabricante
• https://snyk.io/vuln/npm:uglify-js:20150824 · Nota