CVE-2023-45811highCWE-1321

CVE-2023-45811: falha de alta gravidade em relative synchrony

Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Publicada em 17 out 2023 · Atualizada em 13 set 2024

Seguir esta CVE + Monitorar synchrony + Monitorar deobfuscator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.4%

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Produtos afetados

relative · synchrony

Referências

https://github.com/relative/synchrony/commit/b583126be94c4db7c5a478f1c5204bfb4162cf40 https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx https://github.com/relative/synchrony/security/advisories/src/transformers/literalmap.ts