PT-2019-17699 · Larvit · Larvitbase-Api

Ermilov · Publicado 2019-09-03 · Atualizado 2020-10-16 · CVE-2019-5479

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions larvitbase-api versions prior to 0.5.4

Description The issue allows an attacker to load arbitrary non-production code, specifically JavaScript files, due to an unintended require vulnerability. This is possible because the package exposes an API endpoint and passes a GET parameter unsanitized to a require() call, allowing attackers to execute any .js file in the same folder as the server is running.

Recommendations Upgrade to version 0.5.4 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-98

CWE-829

Identificadores relacionados

CVE-2019-5479

GHSA-XF27-JQWV-GF3R

Produtos afetados

Larvitbase-Api

Referências · 5

• 🔥 https://hackerone.com/reports/566056 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5479 · Nota de Segurança
• https://npmjs.com/advisories/1120 · Nota
• https://osv.dev/vulnerability/GHSA-xf27-jqwv-gf3r · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5479 · Aviso do Fabricante