PT-2024-26907 · Unknown · Javascript-Deobfuscator

Steakenthusiast · Published 2024-05-31 · Updated 2024-06-04 · CVE-2024-36120

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions javascript-deobfuscator versions prior to 1.1.0

Description The issue concerns crafted payloads that target expression simplification, potentially leading to code execution. This is related to the expression simplification feature. Users are advised to update to version 1.1.0 to resolve the issue. For users unable to upgrade, disabling the expression simplification feature is recommended as a temporary workaround.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 to resolve the issue. For users unable to upgrade to version 1.1.0, disable the expression simplification feature as a temporary workaround.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-36120

GHSA-9P6P-8V9R-8C9M

Affected Products

Javascript-Deobfuscator

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36120.json · Exploit
• https://github.com/ben-sb/javascript-deobfuscator/security/advisories/GHSA-9p6p-8v9r-8c9m · Vendor Advisory
• https://github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36120 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36120 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p6p-8v9r-8c9m · Vendor Advisory
• https://github.com/ben-sb/javascript-deobfuscator · Note
• https://t.me/cvenotify/81634 · Telegram Post
• https://t.me/cvenotify/81646 · Telegram Post
• https://twitter.com/cracbot/status/1797870972093259884 · Twitter Post