CVE-2023-26121: Prototype Pollution in safe-eval
Platform
nodejs
Component
safe-eval
CVE-2023-26121 identifies a Prototype Pollution vulnerability within the safe-eval package. This flaw allows attackers to inject malicious properties into the global Object.prototype, impacting all objects in the JavaScript environment. Versions of safe-eval prior to 0.4.2 are affected. Applying an upgrade to a patched version is the recommended remediation.
Impact en Aanvalsscenarioswordt vertaald…
Prototype Pollution vulnerabilities, like CVE-2023-26121, can have severe consequences. An attacker exploiting this flaw can modify the behavior of existing JavaScript code by injecting properties into Object.prototype. This can lead to unexpected application behavior, data corruption, and, in some cases, Remote Code Execution (RCE). The safeEval function, specifically, is vulnerable due to insufficient sanitization of input parameters. Successful exploitation could allow an attacker to bypass security controls, escalate privileges, or compromise the entire application.
Uitbuitingscontextwordt vertaald…
CVE-2023-26121 was published on April 11, 2023. There is currently no indication of active exploitation in the wild, but the vulnerability's critical severity and ease of exploitation warrant immediate attention. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Public Proof-of-Concept (POC) code is likely to emerge given the vulnerability's nature and severity.
Dreigingsinformatie
Exploit Status
EPSS
0.10% (28% percentiel)
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Gewijzigd — aanval kan voorbij het kwetsbare component uitbreiden naar andere systemen.
- Confidentiality
- Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Hoog — volledige crash of uitputting van resources. Totale denial of service.
Getroffen Software
Tijdlijn
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2023-26121 is to upgrade to version 0.4.3 or later of the safe-eval package. If upgrading is not immediately feasible, consider implementing input validation and sanitization on any data passed to the safeEval function. While a direct workaround is difficult, restricting the permissions of the application and employing a Web Application Firewall (WAF) with prototype pollution detection rules can help reduce the attack surface. Regularly scan dependencies for known vulnerabilities using tools like npm audit or yarn audit.
Hoe te verhelpenwordt vertaald…
Geen officiële patch beschikbaar. Zoek naar tijdelijke oplossingen of monitor updates.
Veelgestelde vragenwordt vertaald…
What is CVE-2023-26121 — Prototype Pollution in safe-eval?
CVE-2023-26121 is a critical Prototype Pollution vulnerability in the safe-eval package, affecting versions up to 0.4.2. It allows attackers to manipulate object properties, potentially leading to Remote Code Execution (RCE).
Am I affected by CVE-2023-26121 in safe-eval?
If your project uses safe-eval version 0.4.2 or earlier, you are vulnerable. Check your project's dependencies using npm list safe-eval or yarn list safe-eval.
How do I fix CVE-2023-26121 in safe-eval?
Upgrade to version 0.4.3 or later of the safe-eval package. Use npm install safe-eval@latest or yarn add safe-eval@latest to update.
Is CVE-2023-26121 being actively exploited?
There is currently no confirmed active exploitation in the wild, but the vulnerability's severity warrants immediate remediation to prevent potential attacks.
Where can I find the official safe-eval advisory for CVE-2023-26121?
Refer to the package's advisory on the npm registry: [https://www.npmjs.com/advisories/1738](https://www.npmjs.com/advisories/1738)
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...