PT-2024-18938 · Npm · Node-Stringbuilder

Alessio Della Libera

·

Published

2024-07-10

·

Updated

2024-09-09

·

CVE-2024-21524

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions node-stringbuilder versions all
Description The issue arises from incorrect memory length calculation in the node-stringbuilder package, leading to an Out-of-bounds Read. This occurs when methods such as ToBuffer, ToString, or CharAt are called on a StringBuilder object with a non-empty string value input. Providing negative indexes can result in the return of previously allocated memory, leading to an Information Disclosure.
Recommendations For all versions, consider disabling the ToBuffer, ToString, and CharAt methods on StringBuilder objects until a patch is available to prevent potential Information Disclosure. Restrict the use of negative indexes to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-21524
GHSA-G533-XQ5W-JMF3

Affected Products

Node-Stringbuilder