IdoPesok zsa up to 0.3.2 Application Transfer information exposure

Summaryinfo

A vulnerability was found in IdoPesok zsa up to 0.3.2. It has been declared as problematic. Affected is an unknown function of the component Application Transfer Handler. The manipulation results in information exposure. This vulnerability is known as CVE-2024-37162. Access to the local network is required for this attack. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in IdoPesok zsa up to 0.3.2. Affected is some unknown processing of the component Application Transfer Handler. The manipulation with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. This is going to have an impact on confidentiality. CVE summarizes:

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-37162 since 06/03/2024. The exploitability is told to be easy. Access to the local network is required for this attack to succeed. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 0.3.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IdoPesok

Name

• zsa

Version

• 0.3.0
• 0.3.1
• 0.3.2

Website

• Product: https://github.com/IdoPesok/zsa/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion