Executive brief
math.js is a popular JavaScript library for mathematical computations. A vulnerability allows attackers to execute arbitrary code by crafting a malicious typed function with JavaScript code in the function name, potentially compromising any application using the affected library.
Technical details
The vulnerability is a code injection issue (CWE-94) in the typed-function component of math.js. An attacker can inject arbitrary JavaScript code through the function name parameter when creating a typed function, which is then executed by the JavaScript engine without proper sanitization. The attack requires the ability to call the typed function creation API, but no network or authentication bypass is needed. An attacker exploiting this can achieve arbitrary code execution with the privileges of the JavaScript runtime environment. The vulnerability was fixed in version 3.17.0.
Affected products
- math.js math.js before 3.17.0
Timeline
- 2017-12-18: disclosed: Vulnerability published
- 2017-11-18: patched: Fixed in version 3.17.0