CVE-2023-26121: Prototype Pollution in safe-eval
Plataforma
nodejs
Componente
safe-eval
CVE-2023-26121 identifies a Prototype Pollution vulnerability within the safe-eval package. This flaw allows attackers to inject malicious properties into the global Object.prototype, impacting all objects in the JavaScript environment. Versions of safe-eval prior to 0.4.2 are affected. Applying an upgrade to a patched version is the recommended remediation.
Impacto e Cenários de Ataquetraduzindo…
Prototype Pollution vulnerabilities, like CVE-2023-26121, can have severe consequences. An attacker exploiting this flaw can modify the behavior of existing JavaScript code by injecting properties into Object.prototype. This can lead to unexpected application behavior, data corruption, and, in some cases, Remote Code Execution (RCE). The safeEval function, specifically, is vulnerable due to insufficient sanitization of input parameters. Successful exploitation could allow an attacker to bypass security controls, escalate privileges, or compromise the entire application.
Contexto de Exploraçãotraduzindo…
CVE-2023-26121 was published on April 11, 2023. There is currently no indication of active exploitation in the wild, but the vulnerability's critical severity and ease of exploitation warrant immediate attention. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Public Proof-of-Concept (POC) code is likely to emerge given the vulnerability's nature and severity.
Inteligência de Ameaças
Status do Exploit
EPSS
0.10% (percentil 28%)
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Alterado — o ataque pode pivotar para além do componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Alto — falha completa ou esgotamento de recursos. Negação de serviço total.
Software Afetado
Linha do tempo
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2023-26121 is to upgrade to version 0.4.3 or later of the safe-eval package. If upgrading is not immediately feasible, consider implementing input validation and sanitization on any data passed to the safeEval function. While a direct workaround is difficult, restricting the permissions of the application and employing a Web Application Firewall (WAF) with prototype pollution detection rules can help reduce the attack surface. Regularly scan dependencies for known vulnerabilities using tools like npm audit or yarn audit.
Como corrigirtraduzindo…
Nenhum patch oficial disponível. Procure alternativas ou monitore atualizações.
Perguntas frequentestraduzindo…
What is CVE-2023-26121 — Prototype Pollution in safe-eval?
CVE-2023-26121 is a critical Prototype Pollution vulnerability in the safe-eval package, affecting versions up to 0.4.2. It allows attackers to manipulate object properties, potentially leading to Remote Code Execution (RCE).
Am I affected by CVE-2023-26121 in safe-eval?
If your project uses safe-eval version 0.4.2 or earlier, you are vulnerable. Check your project's dependencies using npm list safe-eval or yarn list safe-eval.
How do I fix CVE-2023-26121 in safe-eval?
Upgrade to version 0.4.3 or later of the safe-eval package. Use npm install safe-eval@latest or yarn add safe-eval@latest to update.
Is CVE-2023-26121 being actively exploited?
There is currently no confirmed active exploitation in the wild, but the vulnerability's severity warrants immediate remediation to prevent potential attacks.
Where can I find the official safe-eval advisory for CVE-2023-26121?
Refer to the package's advisory on the npm registry: [https://www.npmjs.com/advisories/1738](https://www.npmjs.com/advisories/1738)
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...