PT-2019-20060 · Npm · Mobile-Icon-Resizer

Published 2019-06-27 · Updated 2019-06-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mobile-icon-resizer versions prior to 0.4.3

Description The issue concerns a code execution vulnerability. It allows dynamic JavaScript payloads to be executed due to the ratio and baseRatio parameters being passed directly to eval(). This vulnerability can be exploited through a specially crafted config.js file, which defines the resulting icons. For example, an attacker could manipulate the baseRatio or ratio properties in the android section of the config.js file to execute malicious code.

Recommendations Update to version 0.4.3 or later. As a temporary workaround, consider restricting the use of the ratio and baseRatio properties in the config.js file to minimize the risk of exploitation. Avoid using the eval() function with untrusted input until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-MXJR-XMCG-FG7W

Affected Products

Mobile-Icon-Resizer

References · 5

• https://osv.dev/vulnerability/GHSA-mxjr-xmcg-fg7w · Vendor Advisory
• https://github.com/muzzley/mobile-icon-resizer/issues/8 · Note
• https://github.com/muzzley/mobile-icon-resizer/commit/a6c50f884bd282d74ab77e1fce6317d5d0dd2f0f · Note
• https://snyk.io/vuln/npm:mobile-icon-resizer:20160408 · Note
• https://npmjs.com/advisories/317 · Note