PT-2024-19818 · Hoolock · Hoolock

Published 2024-01-22 · Updated 2024-01-30 · CVE-2024-23339

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions hoolock versions 2.0.0 through 2.2.0

Description The issue concerns utility functions related to object paths, specifically get, set, and update, which did not block attempts to access or alter object prototypes. This could potentially allow unauthorized access or modification of inherited properties. Starting in version 2.2.1, these functions throw a TypeError when a user attempts to access or alter inherited properties.

Recommendations For hoolock versions 2.0.0 through 2.2.0, update to version 2.2.1 or later, where the get, set, and update functions will throw a TypeError when attempting to access or alter inherited properties, thus mitigating the issue.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-23339

GHSA-4C2G-HX49-7H25

Affected Products

Hoolock

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23339.json · Exploit
• ❌ https://github.com/elijahharry/hoolock/security/advisories/GHSA-4c2g-hx49-7h25 · Vendor Advisory, Deleted
• ❌ https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982 · Patch, Deleted
• https://osv.dev/vulnerability/CVE-2024-23339 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23339 · Security Note
• https://osv.dev/vulnerability/GHSA-4c2g-hx49-7h25 · Vendor Advisory
• https://t.me/cvenotify/68266 · Telegram Post
• https://twitter.com/CVEnew/status/1749571670602649615 · Twitter Post
• https://t.me/cvenotify/68321 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1749607995724435909 · Twitter Post
• ❌ https://github.com/elijahharry/hoolock · Note, Deleted