PT-2023-8584 · Dot-Diver · Dot-Diver

D3Ng03 + 1 · Published 2023-11-03 · Updated 2023-12-26 · CVE-2023-45827

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dot-diver versions prior to 1.0.2

Description The issue is related to a Prototype Pollution vulnerability in the setByPath function, which can lead to remote code execution (RCE). This vulnerability allows an attacker to modify object attributes, potentially enabling them to execute arbitrary code. The vulnerability is present in versions prior to 1.0.2 of the dot-diver library.

Recommendations For versions prior to 1.0.2, upgrade to release 1.0.2 or later to address the Prototype Pollution vulnerability in the setByPath function. As a temporary workaround, consider restricting the use of the setByPath function until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BDU:2024-01227

CVE-2023-45827

GHSA-9W5F-MW3P-PJ47

Affected Products

Dot-Diver

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45827.json · Exploit
• https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47 · Vendor Advisory
• https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45827 · Security Note
• https://osv.dev/vulnerability/GHSA-9w5f-mw3p-pj47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01227 · Security Note
• https://github.com/clickbar/dot-diver · Note
• https://github.com/clickbar/dot-diver/commit/9790834cf4c2bca75db00e588e58056dacaf602f · Note
• https://t.me/true_secator/5246 · Telegram Post
• https://t.me/cibsecurity/73621 · Telegram Post