PT-2021-24446 · Npm · Ua-Parser-Js

Published 2021-10-22 · Updated 2021-10-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ua-parser-js versions 0.7.29, 0.8.0, 1.0.0

Description: The npm package ua-parser-js had malicious code published in certain versions. Any computer with this package installed should be considered fully compromised, and all secrets and keys stored on it should be rotated immediately from a different computer.

Recommendations: For versions 0.7.29, 0.8.0, 1.0.0, upgrade to a newer version as soon as possible and check systems for suspicious activity. Remove the ua-parser-js package, but be aware that this may not remove all malicious software resulting from its installation. Rotate all secrets and keys stored on the compromised computer from a different computer.

Fix

Hidden Functionality

Weakness Enumeration

CWE-829

CWE-912

Related Identifiers

GHSA-PJWM-RVH2-C87W

Affected Products

Ua-Parser-Js

References · 5

• https://osv.dev/vulnerability/GHSA-pjwm-rvh2-c87w · Vendor Advisory
• https://github.com/faisalman/ua-parser-js · Note
• https://github.com/faisalman/ua-parser-js/issues/536 · Note
• https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496 · Note
• https://npmjs.com/package/ua-parser-js · Note