PT-2020-9155 · Valib · Valib

Feng Xiao + 1 · Published 2020-02-28 · Updated 2021-04-13 · CVE-2019-10805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions valib versions through 2.0.0

Description The issue allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.

Recommendations For valib versions through 2.0.0, consider disabling the use of the hasOwnProperty function from unsafe user-input until a patch is available. Restrict access to the inspection functions provided by valib to minimize the risk of exploitation. Avoid using the hasOwnProperty function in the affected JavaScript objects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2019-10805

GHSA-PMPR-VC5Q-H3JW

SNYK-JS-VALIB-559015

Affected Products

Valib

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-VALIB-559015 · Exploit
• https://osv.dev/vulnerability/GHSA-pmpr-vc5q-h3jw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10805 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10805 · Vendor Advisory
• https://npmjs.com/package/valib · Note
• https://t.me/cvenotify/1296 · Telegram Post
• https://t.me/cibsecurity/10186 · Telegram Post