PT-2019-20060 · Npm · Mobile-Icon-Resizer

Publicado 2019-06-27 · Atualizado 2019-06-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mobile-icon-resizer versions prior to 0.4.3

Description The issue concerns a code execution vulnerability. It allows dynamic JavaScript payloads to be executed due to the ratio and baseRatio parameters being passed directly to eval(). This vulnerability can be exploited through a specially crafted config.js file, which defines the resulting icons. For example, an attacker could manipulate the baseRatio or ratio properties in the android section of the config.js file to execute malicious code.

Recommendations Update to version 0.4.3 or later. As a temporary workaround, consider restricting the use of the ratio and baseRatio properties in the config.js file to minimize the risk of exploitation. Avoid using the eval() function with untrusted input until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

GHSA-MXJR-XMCG-FG7W

Produtos afetados

Mobile-Icon-Resizer

Referências · 5

• https://github.com/muzzley/mobile-icon-resizer/issues/8 · Nota
• https://github.com/muzzley/mobile-icon-resizer/commit/a6c50f884bd282d74ab77e1fce6317d5d0dd2f0f · Nota
• https://snyk.io/vuln/npm:mobile-icon-resizer:20160408 · Nota
• https://npmjs.com/advisories/317 · Nota
• https://osv.dev/vulnerability/GHSA-mxjr-xmcg-fg7w · Aviso do Fabricante