PT-2023-23013 · Unknown · @Aedart/Support

Aedart · Publicado 2023-04-28 · Atualizado 2023-05-08 · CVE-2023-30857

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions @aedart/support versions prior to 0.6.1

Description The issue concerns a possible prototype pollution for the MetadataRecord, when merged with a base class' metadata object, in meta decorator from the @aedart/support package. The likelihood of exploitation is questionable, given that a class' metadata can only be set or altered when the class is decorated via meta(). Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 to resolve the issue. As a temporary workaround, consider restricting the use of the meta decorator and limiting the storage of sensitive objects as metadata to minimize the risk of exploitation.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2023-30857

GHSA-WWXH-74FX-33C6

Produtos afetados

@Aedart/Support

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30857.json · Exploit
• https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6 · Aviso do Fabricante
• https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291 · Correção
• https://github.com/aedart/ion · Nota
• https://t.me/cibsecurity/63093 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30857 · Nota de Segurança
• https://t.me/cvenotify/49957 · Publicação no Telegram
• https://t.me/cvenotify/49371 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30857 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wwxh-74fx-33c6 · Aviso do Fabricante