serialize-to-js Package up to 1.1.1 Access Restriction function String resource consumption ⚔ [Disputed]

Summaryinfo

A vulnerability described as problematic has been identified in serialize-to-js Package up to 1.1.1. The impacted element is the function function of the component Access Restriction. Executing a manipulation as part of String can lead to resource consumption. This vulnerability is registered as CVE-2017-15871. It is possible to launch the attack remotely. No exploit is available. There is ongoing doubt regarding the real existence of this vulnerability.

Detailsinfo

A vulnerability was found in serialize-to-js Package up to 1.1.1. It has been declared as critical. This vulnerability affects the function function of the component Access Restriction. The manipulation as part of a String leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

** DISPUTED ** The deserialize function in serialize-to-js through 1.1.1 allows attackers to bypass intended access restrictions via vectors involving a "function()" substring, as demonstrated by a "function(){console.log(" call. NOTE: The vendor states 'In my understanding [this attack] just runs inside a "sandbox" and prints ... to a tty.'

The weakness was published 10/24/2017 (Website). The advisory is available at github.com. This vulnerability was named CVE-2017-15871 since 10/24/2017. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• serialize-to-js Package

Version

• 1.1.0
• 1.1.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion