PT-2022-9414 · Faker.Js+1 · Faker.Js+1

Unknown · Published 2022-01-14 · Updated 2024-06-14 · CVE-2021-23567

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions colors versions after 1.4.0 Faker.js (affected versions not specified)

Description The issue is related to a Denial of Service (DoS) introduced through an infinite loop in the americanFlag module of the colors package. This appears to be a purposeful attempt by a maintainer to make the package unusable. The maintainer of Faker.js also deliberately removed functional code, making it unusable as well.

Recommendations For colors versions after 1.4.0, pin the dependency to 1.4.0 as a temporary workaround. For Faker.js, consider using the forked functional code available at https://github.com/faker-js/faker as an alternative. At the moment, there is no information about a newer version that contains a fix for this issue in Faker.js.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2021-23567

GHSA-5W9C-RV96-FR7G

GHSA-GH88-3PXP-6FM8

SNYK-JS-COLORS-2331906

Affected Products

Faker.Js

Coloros

References · 16

• 🔥 https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640 · Exploit
• 🔥 https://github.com/Marak/colors.js/issues/285 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-COLORS-2331906 · Exploit
• 🔥 https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what · Exploit
• https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 · Patch
• https://osv.dev/vulnerability/CVE-2021-23567 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5w9c-rv96-fr7g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23567 · Security Note
• https://osv.dev/vulnerability/GHSA-gh88-3pxp-6fm8 · Vendor Advisory
• https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6#diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 · Note
• https://github.com/Marak/colors.js · Note
• https://npmjs.com/package/@faker-js/faker · Note
• https://twitter.com/athoshun/status/1801581327285661968 · Twitter Post
• https://github.com/advisories/GHSA-gh88-3pxp-6fm8 · Note
• https://npmjs.com/package/faker · Note