PT-2023-24680 · Zxcvbn-Ts · Zxcvbn-Ts

Balassy · Publicado 2023-06-07 · Atualizado 2023-06-15 · CVE-2023-34109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions zxcvbn-ts versions prior to 3.0.2

Description This issue affects users running on the NodeJS platform who are using the second argument of the zxcvbn function. It can result in unbounded resource consumption as the user inputs array is extended with every function call. Both browsers and NodeJS platforms are impacted, but the effect on browsers requires a significant number of input changes from a single user, whereas the NodeJS process can be more easily affected as it receives inputs from every user of a platform.

Recommendations For versions prior to 3.0.2, upgrade to version 3.0.2 or later. For users unable to upgrade, stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function instead.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-34109

GHSA-38HX-X5HQ-5FG4

Produtos afetados

Zxcvbn-Ts

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34109.json · Exploit
• https://github.com/zxcvbn-ts/zxcvbn/security/advisories/GHSA-38hx-x5hq-5fg4 · Aviso do Fabricante
• https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f6863476822ca857355fba22f · Correção
• https://osv.dev/vulnerability/CVE-2023-34109 · Aviso do Fabricante
• https://t.me/cvenotify/51964 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-34109 · Nota de Segurança