vulnwire
9.8crit

CVE-2017-5941in critical feed3 exploits

Code Execution through IIFE in node-serialize

Also known as GHSA-q4v7-4rhw-9hqm

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
61.0%
percentile 99%
Public exploits
3
Exploit-DB

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

Exploit prediction (EPSS)

61.02% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-50036 Node.JS - 'node-serialize' Remote Code Execution (3) · webapps · 2021-06-18
  • EDB-49552 Node.JS - 'node-serialize' Remote Code Execution (2) · webapps · 2021-02-10
  • EDB-45265 Node.JS - 'node-serialize' Remote Code Execution · remote · 2017-02-08

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
npmnode-serialize
<=0.0.4
no fix listed

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • nodesecurity.io /advisories/311 · x_refsource_MISC, x_transferred
  • opsecx.com /index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/96225 · vdb-entry, x_refsource_BID, x_transferred
  • packetstormsecurity.com /files/161356/Node.JS-Remote-Code-Execution.html · x_refsource_MISC, x_transferred
  • packetstormsecurity.com /files/163222/Node.JS-Remote-Code-Execution.html · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-5941 · advisory
  • github.com /luin/serialize/issues/4 · web
  • github.com /advisories/GHSA-q4v7-4rhw-9hqm · advisory
  • opsecx.com /index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution · web
  • npmjs.com /advisories/311 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.