PT-2023-29701 · Node.Js+1 · Node.Js+1

Steakenthusiast

·

Published

2023-10-17

·

Updated

2023-12-26

·

CVE-2023-45811

CVSS v3.1

8.1

High

VectorAV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Synchrony deobfuscator versions prior to 2.4.4
Description A proto pollution vulnerability exists in the LiteralMap transformer, allowing crafted input to modify properties in the Object prototype. Successful exploitation could lead to arbitrary code execution. The vulnerability is caused by defining a parser property on proto with a path to a JS module on disk, which can lead to arbitrary code execution when executing in Node.js.
Recommendations For versions prior to 2.4.4, upgrade to deobfuscator@2.4.4 to fix the issue. As a temporary workaround, consider launching node with the [--disable-proto=delete] or [--disable-proto=throw] flags to minimize the risk of exploitation. Restrict access to the LiteralMap transformer to prevent crafted input from modifying properties in the Object prototype. Avoid using the parser property on proto in the affected API endpoint until the issue is resolved.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-45811
GHSA-JG82-XH3W-RHXX

Affected Products

Node.Js
Synchrony Deobfuscator