PT-2017-16784 · Npm · Serialize-To-Js

Ajinabraham · Published 2017-02-10 · Updated 2018-07-18 · CVE-2017-5954

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions serialize-to-js versions 0.5.0

Description An issue in the serialize-to-js package allows untrusted data passed into the deserialize() function to be exploited for arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE). This can be achieved by crafting a specific payload, such as a variable payload containing a malicious JavaScript Object. The exploitation involves using the deserialize() function from the serialize-to-js package, which can lead to code execution.

Recommendations Update to version 1.0.0 or later, and review the disclaimer from the author regarding the deserialize() function to understand its safe usage.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-5954

GHSA-MM62-WXC8-CF7M

Affected Products

Serialize-To-Js

References · 11

• 🔥 https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution · Exploit
• https://github.com/commenthol/serialize-to-js/issues/1 · Patch
• https://osv.dev/vulnerability/GHSA-mm62-wxc8-cf7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5954 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5954 · Vendor Advisory
• https://github.com/commenthol/serialize-to-js/commit/1cd433960e5b9db4c0b537afb28366198a319429 · Note
• https://github.com/commenthol/serialize-to-js · Note
• https://npmjs.com/package/serialize-to-js#deserialize · Note
• http://securityfocus.com/bid/96223 · Note
• https://github.com/advisories/GHSA-mm62-wxc8-cf7m · Note
• https://npmjs.com/advisories/313 · Note