PT-2017-10978 · Unknown · Typed-Function

Masato Kinugawa · Published 2017-11-27 · Updated 2020-09-02 · CVE-2017-1001004

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions typed-function versions prior to 0.10.6

Description The issue allows for arbitrary code execution in the JavaScript engine. This can occur when creating a typed function with JavaScript code in the name, potentially leading to arbitrary execution. The problem stems from improper sanitization of function names, which may enable an attacker to execute arbitrary code.

Recommendations For versions prior to 0.10.6, upgrade to version 0.10.6 or later.

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2017-1001004

GHSA-3QH4-R86R-GRVM

Affected Products

Typed-Function

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-1001004 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1001004 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qh4-r86r-grvm · Vendor Advisory
• https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe · Note
• https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8 · Note
• https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106 · Note
• https://npmjs.com/advisories/819 · Note
• https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139 · Note