webcrack hat eine Arbitrary File Write Vulnerability auf Windows beim Parsen und Speichern eines bösartigen Bundles.

The primary impact of CVE-2024-43373 is the potential for arbitrary file overwrites on a Windows system. An attacker can leverage this vulnerability by crafting malicious code that exploits the unpack bundles feature in conjunction with the saving feature. By including path traversal sequences (e.g., ../) within the module name, an attacker can bypass security controls and overwrite critical system files or application data. This could lead to system compromise, data loss, or denial of service. The ability to overwrite files grants significant control over the affected system, potentially allowing for the execution of arbitrary code.

Organizations and developers using the webcrack Node.js package in their applications, particularly those deploying on Windows systems, are at risk. This includes developers integrating webcrack into custom tools or applications, and those relying on webcrack within larger Node.js projects. Shared hosting environments where multiple users share the same server are also at increased risk if one user's application is compromised.

• nodejs / server:

find / -name "webcrack" -type d -print0 | xargs -0 ls -l

• nodejs / server:

ps aux | grep webcrack

• generic web: Inspect web server access logs for requests containing suspicious file paths or path traversal sequences (e.g., ../). • generic web: Review web application code for any instances where user-supplied input is used to construct file paths without proper sanitization.

1. 2024-08-14Disclosure

   disclosure

1. Reserviert2024-08-09
2. Veröffentlicht2024-08-14
3. Geändert2024-11-18
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-43373 is to upgrade to webcrack version 2.14.1 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing stricter input validation on the module name parameter within the unpack bundles feature. This should prevent the inclusion of path traversal sequences. Additionally, restrict the permissions of the process running webcrack to minimize the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to trigger the unpack bundles feature with a crafted module name containing path traversal sequences; the operation should fail with an appropriate error.