PT-2019-17699 · Larvit · Larvitbase-Api

Ermilov · Published 2019-09-03 · Updated 2020-10-16 · CVE-2019-5479

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions larvitbase-api versions prior to 0.5.4

Description The issue allows an attacker to load arbitrary non-production code, specifically JavaScript files, due to an unintended require vulnerability. This is possible because the package exposes an API endpoint and passes a GET parameter unsanitized to a require() call, allowing attackers to execute any .js file in the same folder as the server is running.

Recommendations Upgrade to version 0.5.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-98

CWE-829

Related Identifiers

CVE-2019-5479

GHSA-XF27-JQWV-GF3R

Affected Products

Larvitbase-Api

References · 5

• 🔥 https://hackerone.com/reports/566056 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5479 · Security Note
• https://osv.dev/vulnerability/GHSA-xf27-jqwv-gf3r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5479 · Vendor Advisory
• https://npmjs.com/advisories/1120 · Note