PT-2024-23492 · Unknown · Inandrei-Tatar Nora-Firebase-Common

Mestrtee · Published 2024-04-18 · Updated 2024-08-22 · CVE-2024-30564

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions inandrei-tatar nora-firebase-common versions 1.0.41 through 1.12.2

Description The issue allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal() method. This enables the attacker to cause a state issue.

Recommendations For versions 1.0.41 through 1.12.2, apply the latest security patch to mitigate the issue. As a temporary workaround, consider restricting access to the updateStateInternal() method until a patch is available. Avoid using the updateState parameter in the affected method until the issue is resolved.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-30564

GHSA-JJFF-Q3Q4-5HH8

Affected Products

Inandrei-Tatar Nora-Firebase-Common

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-30564 · Security Note
• https://osv.dev/vulnerability/GHSA-jjff-q3q4-5hh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30564 · Vendor Advisory
• https://github.com/andrei-tatar/nora-firebase-common · Note
• https://github.com/andrei-tatar/nora-firebase-common/commit/bf30b75d51be04f6c1f884561a223226c890f01b · Note
• https://github.com/andrei-tatar/nora-firebase-common/issues/9 · Note
• https://twitter.com/CVEnew/status/1781029449179300310 · Twitter Post
• https://t.me/cvenotify/91753 · Telegram Post
• https://gist.github.com/mestrtee/5dc2c948c2057f98d3de0a9790903c6c · Note
• https://t.me/cvenotify/78080 · Telegram Post
• https://twitter.com/oktsec/status/1781030660456546645 · Twitter Post