PT-2022-26207 · Sonicjs · Sonicjs

Published 2022-09-30 · Updated 2022-10-04 · CVE-2022-42002

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonicJS versions 0.6.0 and earlier

Description The issue allows for file overwrite due to the lack of authentication required for certain file update mutations. Specifically, the fileCreate and fileUpdate mutations can be called without authentication, leading to arbitrary file write and delete capabilities on a SonicJS application.

Recommendations For SonicJS versions 0.6.0 and earlier, as a temporary workaround, consider disabling the fileCreate and fileUpdate mutations until a patch is available. Restrict access to these mutations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-42002

Affected Products

Sonicjs

References · 5

• 🔥 https://snyk.io/blog/graphql-security-static-analysis-snyk-code · Exploit
• https://osv.dev/vulnerability/CVE-2022-42002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42002 · Security Note
• https://github.com/lane711/sonicjs/tags · Note
• https://t.me/cibsecurity/50817 · Telegram Post