PT-2022-17574 · Facebook · React
Feng Xiao
+1
·
Published
2022-06-03
·
Updated
2022-06-17
·
CVE-2022-25863
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
gatsby-plugin-mdx versions 3.0.0 through 3.15.1
gatsby-plugin-mdx versions 2.14.0 and earlier
Description
The gatsby-plugin-mdx plugin is vulnerable to Deserialization of Untrusted Data when passing input through to the
gray-matter package, due to its default configurations that are missing input sanitization. This vulnerability can be exploited when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). The injected JavaScript executes in the context of the build server. To exploit this vulnerability, untrusted/unsanitized input would need to be sourced or added into an MDX file.Recommendations
For gatsby-plugin-mdx versions 3.0.0 through 3.15.1, update to version 3.15.2 or later.
For gatsby-plugin-mdx versions 2.14.0 and earlier, update to version 2.14.1 or later.
If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
As a temporary workaround, consider disabling the
JSFrontmatterEngine option to mitigate the risk of exploitation.Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
React