PT-2023-23013 · Unknown · @Aedart/Support

Aedart · Published 2023-04-28 · Updated 2023-05-08 · CVE-2023-30857

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions @aedart/support versions prior to 0.6.1

Description The issue concerns a possible prototype pollution for the MetadataRecord, when merged with a base class' metadata object, in meta decorator from the @aedart/support package. The likelihood of exploitation is questionable, given that a class' metadata can only be set or altered when the class is decorated via meta(). Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 to resolve the issue. As a temporary workaround, consider restricting the use of the meta decorator and limiting the storage of sensitive objects as metadata to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-30857

GHSA-WWXH-74FX-33C6

Affected Products

@Aedart/Support

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30857.json · Exploit
• https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6 · Vendor Advisory
• https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-30857 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30857 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wwxh-74fx-33c6 · Vendor Advisory
• https://github.com/aedart/ion · Note
• https://t.me/cibsecurity/63093 · Telegram Post
• https://t.me/cvenotify/49957 · Telegram Post
• https://t.me/cvenotify/49371 · Telegram Post