GHSA-5888-ffcr-r425

Source

https://github.com/advisories/GHSA-5888-ffcr-r425

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-5888-ffcr-r425/GHSA-5888-ffcr-r425.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5888-ffcr-r425

Aliases

CVE-2022-23631

Related

CVE-2022-23631

Published

2022-02-09T22:20:49Z

Modified

2023-11-08T04:08:25.737732Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Prototype Pollution leading to Remote Code Execution in superjson

Details

Impact

This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. In the case of Blitz.js, it would be at least one RPC call.

Patches

This has been patched in superjson 1.8.1 and Blitz.js 0.45.3.

If you are unable to upgrade to Blitz.js 0.45.3 in a timely manner, you can instead upgrade only superjson to version 1.8.1 using yarn resolutions are similar. Blitz versions < 0.45.3 are only affected because they used superjson versions < 1.8.1.

Workarounds

None

For more information

If you have any questions or comments about this advisory: * Open an issue in https://github.com/blitz-js/superjson * Email us at b@bayer.ws

References

https://www.sonarsource.com/blog/blitzjs-prototype-pollution/

Database specific

{
    "nvd_published_at": "2022-02-09T22:15:00Z",
    "severity": "CRITICAL",
    "github_reviewed_at": "2022-02-09T22:20:49Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ]
}

References

Affected packages

npm / superjson

Package

Name: superjson; View open source insights on deps.dev
Purl: pkg:npm/superjson

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.1

npm / blitz

Package

Name: blitz; View open source insights on deps.dev
Purl: pkg:npm/blitz

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.45.3