PT-2019-12032 · Npm · Safe-Eval

Beny Zeltser · Publicado 2019-10-15 · Atualizado 2021-07-21 · CVE-2019-10759

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions safer-eval versions prior to 1.3.4

Description The issue allows for Arbitrary Code Execution through a Sandbox Escape. This can be achieved by using constructor properties to escape the sandbox, enabling the execution of arbitrary code. For example, evaluating the string console.constructor.constructor('return process')().env can print process.env to the console.

Recommendations Upgrade to version 1.3.4 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-10759

GHSA-R3X4-WR4H-PW33

SNYK-JS-SAFEREVAL-173772

Produtos afetados

Safe-Eval

Referências · 5

• 🔥 https://snyk.io/vuln/SNYK-JS-SAFEREVAL-173772 · Exploit
• https://npmjs.com/advisories/1021 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10759 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10759 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r3x4-wr4h-pw33 · Aviso do Fabricante