PT-2023-24680 · Zxcvbn-Ts · Zxcvbn-Ts

Balassy · Published 2023-06-07 · Updated 2023-06-15 · CVE-2023-34109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions zxcvbn-ts versions prior to 3.0.2

Description This issue affects users running on the NodeJS platform who are using the second argument of the zxcvbn function. It can result in unbounded resource consumption as the user inputs array is extended with every function call. Both browsers and NodeJS platforms are impacted, but the effect on browsers requires a significant number of input changes from a single user, whereas the NodeJS process can be more easily affected as it receives inputs from every user of a platform.

Recommendations For versions prior to 3.0.2, upgrade to version 3.0.2 or later. For users unable to upgrade, stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function instead.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-34109

GHSA-38HX-X5HQ-5FG4

Affected Products

Zxcvbn-Ts

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34109.json · Exploit
• https://github.com/zxcvbn-ts/zxcvbn/security/advisories/GHSA-38hx-x5hq-5fg4 · Vendor Advisory
• https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f6863476822ca857355fba22f · Patch
• https://osv.dev/vulnerability/CVE-2023-34109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34109 · Security Note
• https://t.me/cvenotify/51964 · Telegram Post