Babel Traverse up to 7.23.1/8.0.0-alpha.3 incomplete blacklist

Summaryinfo

A vulnerability has been found in Babel Traverse up to 7.23.1/8.0.0-alpha.3 and classified as critical. Impacted is an unknown function. Performing a manipulation results in incomplete blacklist. This vulnerability is cataloged as CVE-2023-45133. The attack must be initiated from a local position. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Babel Traverse up to 7.23.1/8.0.0-alpha.3. This affects an unknown part. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. CWE is classifying the issue as CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/[email protected]` and `@babel/[email protected]`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.

The weakness was shared 10/12/2023 as GHSA-67hx-6x53-jw92. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-45133 since 10/04/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1562.006 for this issue.

Upgrading to version 7.23.2 or 8.0.0-alpha.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch b13376b346946e3f62fc0848c1d2a23223314c82 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2923). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Atlassian Bamboo
• Atlassian Bitbucket
• Atlassian Confluence
• Atlassian Crucible
• Atlassian Fisheye
• Atlassian Jira

Productinfo

Vendor

• Babel

Name

• Traverse

Version

• 7.23.0
• 7.23.1
• 8.0.0-alpha.0
• 8.0.0-alpha.1
• 8.0.0-alpha.2
• 8.0.0-alpha.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion