PT-2023-20514 · Flatnest · Flatnest

Peng Zhou + 1 · Published 2023-06-30 · Updated 2024-02-07 · CVE-2023-26135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flatnest versions all

Description The issue concerns Prototype Pollution via the nest() function in the flatnest/nest.js file. This affects all versions of the package flatnest.

Recommendations For all versions, consider disabling the nest() function as a temporary workaround until a patch is available. Restrict access to the flatnest/nest.js file to minimize the risk of exploitation. Avoid using the nest() function in sensitive operations until the issue is resolved.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-26135

GHSA-7PX2-3C2P-Q4V4

Affected Products

Flatnest

References · 10

• 🔥 https://github.com/brycebaril/node-flatnest/issues/4 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-FLATNEST-3185149 · Exploit
• https://osv.dev/vulnerability/GHSA-7px2-3c2p-q4v4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26135 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26135 · Vendor Advisory
• https://github.com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js%23L43 · Note
• https://github.com/brycebaril/node-flatnest/commit/27d569baf9d9d25677640edeaf2d13af165868d6 · Note
• https://github.com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js#L43 · Note
• https://github.com/brycebaril/node-flatnest · Note
• https://t.me/cibsecurity/65780 · Telegram Post