PT-2017-4099 · Microsoft · Uglify-Js

Published 2017-01-23 · Updated 2021-10-28 · CVE-2015-8857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uglify-js versions prior to 2.4.24

Description The issue is related to errors in input syntax checking in the uglify-js library, which may allow a remote attacker to execute arbitrary code using a specially crafted JavaScript. The vulnerability is caused by the library not properly accounting for non-boolean values when rewriting boolean expressions, potentially allowing attackers to bypass security mechanisms. This may have an unspecified impact by leveraging improperly rewritten JavaScript. Crafted JavaScript may have altered functionality after minification.

Recommendations Upgrade UglifyJS to version >= 2.4.24.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-254

CWE-1254

CWE-95

CWE-670

Related Identifiers

BDU:2021-02856

CVE-2015-8857

GHSA-34R7-Q49F-H37C

GHSA-G6F4-J6C2-W3P3

Affected Products

Uglify-Js

References · 23

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml · Exploit
• 🔥 https://nodesecurity.io/advisories/39 · Exploit
• https://osv.dev/vulnerability/CVE-2015-8857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8857 · Security Note
• https://osv.dev/vulnerability/GHSA-g6f4-j6c2-w3p3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8857 · Security Note
• https://ubuntu.com/security/CVE-2015-8857 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8857 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8857 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8857 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02856 · Security Note
• https://osv.dev/vulnerability/GHSA-34r7-q49f-h37c · Vendor Advisory
• https://github.com/mishoo/UglifyJS2 · Note
• https://github.com/mishoo/UglifyJS2/issues/751 · Note
• https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e · Note