PT-2023-29701 · Node.Js+1 · Node.Js+1
Steakenthusiast
·
Publicado
2023-10-17
·
Atualizado
2023-12-26
·
CVE-2023-45811
CVSS v3.1
8.1
Alta
| Vetor | AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Synchrony deobfuscator versions prior to 2.4.4
Description
A
proto pollution vulnerability exists in the LiteralMap transformer, allowing crafted input to modify properties in the Object prototype. Successful exploitation could lead to arbitrary code execution. The vulnerability is caused by defining a parser property on proto with a path to a JS module on disk, which can lead to arbitrary code execution when executing in Node.js.Recommendations
For versions prior to 2.4.4, upgrade to
deobfuscator@2.4.4 to fix the issue.
As a temporary workaround, consider launching node with the [--disable-proto=delete] or [--disable-proto=throw] flags to minimize the risk of exploitation.
Restrict access to the LiteralMap transformer to prevent crafted input from modifying properties in the Object prototype.
Avoid using the parser property on proto in the affected API endpoint until the issue is resolved.Exploit
Correção
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Node.Js
Synchrony Deobfuscator