PT-2017-14251 · Unknown · Serialize-To-Js

Published 2017-10-24 · Updated 2024-08-05 · CVE-2017-15871

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions serialize-to-js versions 1.1.1 and earlier

Description The issue allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring. This can be demonstrated by a "function(){console.log(" call or a simple infinite loop. The vendor acknowledges that denial of service can occur, noting that the deserialize function is explicitly listed as "harmful" within the README.md file.

Recommendations For serialize-to-js versions 1.1.1 and earlier, consider avoiding the use of the deserialize function until a safer alternative is provided, as it is explicitly listed as "harmful". As a temporary workaround, consider restricting the input to the deserialize function to prevent exploitation via vectors involving an Immediately Invoked Function Expression "function()" substring.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2017-15871

Affected Products

Serialize-To-Js

References · 5

• 🔥 https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15871 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15871 · Vendor Advisory
• https://github.com/commenthol/serialize-to-js/issues/3 · Note
• https://t.me/cvenotify/89269 · Telegram Post