PT-2019-12041 · Npm · Safe-Eval

Jonathan Leitschuh · Publicado 2019-12-06 · Atualizado 2021-07-21 · CVE-2019-10769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions safer-eval versions all

Description The issue concerns the safer-eval npm package, which is used to sandbox the evaluation of code within the eval function. It is vulnerable to Arbitrary Code Execution via generating a RangeError and Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input, potentially allowing attackers to execute arbitrary code in the system.

Recommendations For all versions, consider using an alternative package until a fix is made available, as the safer-eval package is not meant to receive user input.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

CVE-2019-10769

GHSA-V63X-XC9J-HHVQ

SNYK-JS-SAFEREVAL-534901

Produtos afetados

Safe-Eval

Referências · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-SAFEREVAL-534901 · Exploit
• https://github.com/commenthol/safer-eval/security/advisories/GHSA-v63x-xc9j-hhvq · Nota
• https://npmjs.com/advisories/1428 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10769 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-v63x-xc9j-hhvq · Aviso do Fabricante
• https://github.com/advisories/GHSA-v63x-xc9j-hhvq · Nota
• https://osv.dev/vulnerability/CVE-2019-10769 · Aviso do Fabricante