PT-2022-17597 · Safe-Eval · Safe-Eval

Peng Zhou + 1 · Published 2022-12-20 · Updated 2022-12-29 · CVE-2022-25904

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions safe-eval versions all

Description The issue allows an attacker to add or modify properties of the Object.prototype through Prototype Pollution when using the function safeEval. This is due to the function's use of the vm variable, enabling an attacker to modify properties of the Object.prototype.

Recommendations For all versions, consider disabling the use of the safeEval function until a patch is available to prevent exploitation. Restrict access to the vm variable to minimize the risk of modifying the Object.prototype properties.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-25904

GHSA-33VH-7X8Q-MG35

Affected Products

Safe-Eval

References · 8

• 🔥 https://github.com/hacksparrow/safe-eval/issues/26 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701 · Exploit
• https://osv.dev/vulnerability/GHSA-33vh-7x8q-mg35 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25904 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25904 · Vendor Advisory
• https://github.com/hacksparrow/safe-eval · Note
• https://t.me/cvenotify/40961 · Telegram Post
• https://t.me/cibsecurity/54947 · Telegram Post