PT-2022-9014 · Furqan · Node-Whois

Zero734Kr · Published 2022-12-19 · Updated 2022-12-29 · CVE-2020-36618

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Furqan node-whois (affected versions not specified)

Description A critical vulnerability has been found in Furqan node-whois, affecting an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes, known as 'prototype pollution'. This issue can be exploited remotely.

Recommendations To fix this issue, it is recommended to apply a patch with the name 46ccc2aee8d063c7b6b4dee2c2834113b7286076. As a temporary workaround, consider restricting access to the index.coffee file until the patch is applied.

Exploit

Fix

Prototype Pollution

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-1321

CWE-74

CWE-94

Related Identifiers

CVE-2020-36618

GHSA-97JV-C342-5XHC

Affected Products

Node-Whois

References · 10

• 🔥 https://github.com/FurqanSoftware/node-whois/pull/105 · Exploit
• https://github.com/FurqanSoftware/node-whois/commit/46ccc2aee8d063c7b6b4dee2c2834113b7286076 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36618 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36618 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-97jv-c342-5xhc · Vendor Advisory
• https://github.com/FurqanSoftware/node-whois · Note
• https://t.me/cvenotify/40954 · Telegram Post
• https://vuldb.com/?id.216252 · Note
• https://web.archive.org/web/20220403104013/https://npmjs.com/package/whois · Note
• https://t.me/cibsecurity/54861 · Telegram Post