PT-2024-20341 · Unknown · @Blackprint/Engine

Mestrtee · Published 2024-05-20 · Updated 2024-07-03 · CVE-2024-24294

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @blackprint/engine versions 0.8.12 through 0.9.1

Description A Prototype Pollution issue allows an attacker to execute arbitrary code via the utils.setDeepProperty function of engine.min.js. This issue enables the execution of arbitrary code, potentially leading to severe security consequences.

Recommendations For @blackprint/engine versions 0.8.12 through 0.9.1, consider disabling the utils.setDeepProperty function as a temporary workaround until a patch is available. Restrict access to the engine.min.js file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2024-24294

GHSA-G3Q2-VCJQ-RGRC

Affected Products

@Blackprint/Engine

References · 6

• https://osv.dev/vulnerability/GHSA-g3q2-vcjq-rgrc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24294 · Security Note
• https://github.com/Blackprint/engine-js · Note
• https://github.com/Blackprint/engine-js/commit/bd6b965b03c467e7a58ab0cb89b9172fa5e07013 · Note
• https://t.me/cvenotify/80471 · Telegram Post
• https://gist.github.com/mestrtee/d1eb6e1f7c6dd60d8838c3e56cab634d · Note