PT-2024-28852 · Unknown · Squirrelly

Owoverflow · Published 2024-08-21 · Updated 2024-08-25 · CVE-2024-40453

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions squirrellyjs squirrelly version 9.0.0

Description The issue is a code injection vulnerability via the component options.varName. This vulnerability was discovered in squirrellyjs squirrelly and was fixed in version 9.0.1, however, another source indicates it was fixed in version 9.1.0.

Recommendations For version 9.0.0, update to version 9.0.1 or 9.1.0 to resolve the issue. As a temporary workaround, consider restricting the use of the options.varName component until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-40453

GHSA-W5PW-GMCW-RFC8

Affected Products

Squirrelly

References · 12

• 🔥 https://samuzora.com/posts/cve-2024-40453 · Exploit
• https://github.com/squirrellyjs/squirrelly/pull/262 · Patch
• https://osv.dev/vulnerability/CVE-2024-40453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40453 · Security Note
• https://osv.dev/vulnerability/GHSA-w5pw-gmcw-rfc8 · Vendor Advisory
• https://github.com/squirrellyjs/squirrelly · Note
• https://github.com/squirrellyjs/squirrelly/commit/426f930e5ca1501404cd887071e734ec5feb0bcf · Note
• https://t.me/cvenotify/91981 · Telegram Post
• https://twitter.com/CVEnew/status/1826306776364454370 · Twitter Post
• https://t.me/cvedetector/3802 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1826327267691139084 · Twitter Post
• https://twitter.com/cracbot/status/1827949187935404414 · Twitter Post