PT-2021-6839 · Jszip · Jszip

Dave Holoway · Published 2021-05-01 · Updated 2021-08-27 · CVE-2021-23413

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions jszip versions prior to 3.7.0

Description The issue is related to the incorrect handling of file names in the jszip library. It allows a remote attacker to cause a denial of service by crafting a new zip file with filenames set to Object prototype values, such as proto or toString, resulting in a returned object with a modified prototype instance.

Recommendations For versions prior to 3.7.0, update to version 3.7.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the jszip library until a patch is applied. Avoid using the jszip library to process zip files with filenames that could be set to Object prototype values.

Exploit

Fix

Code Injection

Prototype Pollution

Weakness Enumeration

CWE-94

CWE-1321

Related Identifiers

BDU:2022-02264

CVE-2021-23413

GHSA-JG8V-48H5-WGXG

SNYK-JAVA-ORGWEBJARS-1251499

SNYK-JAVA-ORGWEBJARSNPM-1251498

SNYK-JS-JSZIP-1251497

Affected Products

Jszip

References · 19

• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-JSZIP-1251497 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498 · Exploit
• https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23413 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23413 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23413 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jg8v-48h5-wgxg · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23413 · Security Note
• https://bdu.fstec.ru/vul/2022-02264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23413 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23413 · Vendor Advisory
• https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88 · Note
• https://github.com/Stuk/jszip/pull/766 · Note