PT-2020-19254 · Hot · Hot-Formula-Parser

Published 2020-01-11 · Updated 2020-05-06 · CVE-2020-6836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hot-formula-parser versions prior to 3.0.1

Description The issue allows for arbitrary code injection due to the failure to sanitize values passed to the parse function, which are then concatenated in an eval call. If a formula value is taken from user-controlled input, attackers may be able to run arbitrary commands on the server. For example, parsing a specific formula can create a file in the present directory.

Recommendations For versions prior to 3.0.1, upgrade to version 3.0.1 or later. As a temporary workaround, consider restricting the use of the parse function to prevent exploitation until a patch is applied. Avoid using the hot-formula-parser package with user-controlled input until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-6836

GHSA-RC77-XXQ6-4MFF

Affected Products

Hot-Formula-Parser

References · 8

• https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e · Patch
• https://npmjs.com/advisories/1439 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-6836 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6836 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rc77-xxq6-4mff · Vendor Advisory
• https://github.com/handsontable/formula-parser · Note
• https://github.com/handsontable/formula-parser/pull/58 · Note
• https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser · Note