PT-2024-30525 · Unknown · Ecmascript

Arai-A + 1 · Published 2024-08-14 · Updated 2024-08-19 · CVE-2024-43357

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions ECMAScript (affected versions not specified)

Description A problem in the ECMAScript specification of async generators may lead to mis-implementation in a way that could present as a security issue, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult objects, assuming that these objects will not be then-ables. However, these objects can be made then-able, triggering arbitrary behavior, including re-entering the async generator machinery in a way that violates some internal invariants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implementors should refer to the latest ECMAScript specification and update their implementations to comply with the AsyncGenerator section. Users unable to upgrade to the patched version would want to use exception handling mechanisms to ensure any exceptions caused by the engine don't impact the availability of the main application.

Exploit

Type Confusion

NULL Pointer Dereference

Weakness Enumeration

CWE-248

CWE-843

CWE-476

Related Identifiers

CVE-2024-43357

GHSA-F67Q-WR6W-23JQ

GHSA-G38C-WH3C-5H9R

RUSTSEC-2024-0444

Affected Products

Ecmascript

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43357.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-43357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43367 · Security Note
• https://osv.dev/vulnerability/GHSA-f67q-wr6w-23jq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43357 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0444 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-7652 · Security Note
• https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r · Note
• https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3 · Note
• https://github.com/tc39/ecma262/pull/2413 · Note
• https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 · Note
• https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq · Note
• https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7 · Note
• https://github.com/boa-dev/boa · Note
• https://issues.chromium.org/issues/346692561 · Note