CVE-2023-26121: Prototype Pollution in safe-eval
Plateforme
nodejs
Composant
safe-eval
CVE-2023-26121 identifies a Prototype Pollution vulnerability within the safe-eval package. This flaw allows attackers to inject malicious properties into the global Object.prototype, impacting all objects in the JavaScript environment. Versions of safe-eval prior to 0.4.2 are affected. Applying an upgrade to a patched version is the recommended remediation.
Impact et Scénarios d'Attaquetraduction en cours…
Prototype Pollution vulnerabilities, like CVE-2023-26121, can have severe consequences. An attacker exploiting this flaw can modify the behavior of existing JavaScript code by injecting properties into Object.prototype. This can lead to unexpected application behavior, data corruption, and, in some cases, Remote Code Execution (RCE). The safeEval function, specifically, is vulnerable due to insufficient sanitization of input parameters. Successful exploitation could allow an attacker to bypass security controls, escalate privileges, or compromise the entire application.
Contexte d'Exploitationtraduction en cours…
CVE-2023-26121 was published on April 11, 2023. There is currently no indication of active exploitation in the wild, but the vulnerability's critical severity and ease of exploitation warrant immediate attention. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Public Proof-of-Concept (POC) code is likely to emerge given the vulnerability's nature and severity.
Renseignement sur les Menaces
Statut de l'Exploit
EPSS
0.10% (percentile 28%)
Vecteur CVSS
Que signifient ces métriques?
- Attack Vector
- Réseau — exploitable à distance via internet. Aucun accès physique ou local requis.
- Attack Complexity
- Faible — aucune condition spéciale requise. Exploitable de manière fiable.
- Privileges Required
- Aucun — sans authentification. Aucune identifiant requis pour exploiter.
- User Interaction
- Aucune — attaque automatique et silencieuse. La victime ne fait rien.
- Scope
- Modifié — l'attaque peut pivoter au-delà du composant vulnérable.
- Confidentiality
- Élevé — perte totale de confidentialité. L'attaquant peut lire toutes les données.
- Integrity
- Élevé — l'attaquant peut écrire, modifier ou supprimer toutes les données.
- Availability
- Élevé — panne complète ou épuisement des ressources. Déni de service total.
Logiciel Affecté
Chronologie
- Publiée
- Modifiée
- EPSS mis à jour
Mitigation et Contournementstraduction en cours…
The primary mitigation for CVE-2023-26121 is to upgrade to version 0.4.3 or later of the safe-eval package. If upgrading is not immediately feasible, consider implementing input validation and sanitization on any data passed to the safeEval function. While a direct workaround is difficult, restricting the permissions of the application and employing a Web Application Firewall (WAF) with prototype pollution detection rules can help reduce the attack surface. Regularly scan dependencies for known vulnerabilities using tools like npm audit or yarn audit.
Comment corrigertraduction en cours…
Aucun correctif officiel disponible. Recherchez des alternatives ou surveillez les mises à jour.
Questions fréquentestraduction en cours…
What is CVE-2023-26121 — Prototype Pollution in safe-eval?
CVE-2023-26121 is a critical Prototype Pollution vulnerability in the safe-eval package, affecting versions up to 0.4.2. It allows attackers to manipulate object properties, potentially leading to Remote Code Execution (RCE).
Am I affected by CVE-2023-26121 in safe-eval?
If your project uses safe-eval version 0.4.2 or earlier, you are vulnerable. Check your project's dependencies using npm list safe-eval or yarn list safe-eval.
How do I fix CVE-2023-26121 in safe-eval?
Upgrade to version 0.4.3 or later of the safe-eval package. Use npm install safe-eval@latest or yarn add safe-eval@latest to update.
Is CVE-2023-26121 being actively exploited?
There is currently no confirmed active exploitation in the wild, but the vulnerability's severity warrants immediate remediation to prevent potential attacks.
Where can I find the official safe-eval advisory for CVE-2023-26121?
Refer to the package's advisory on the npm registry: [https://www.npmjs.com/advisories/1738](https://www.npmjs.com/advisories/1738)
Ton projet est-il affecté ?
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Essayez maintenant — sans compte
scanZone.subtitle
Glissez-déposez votre fichier de dépendances
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...