Executive brief
math.js is a popular JavaScript library for mathematical operations and expressions. The vulnerability allowed attackers to bypass property access restrictions by using unicode character variants to reference forbidden properties like "constructor," potentially enabling arbitrary code execution in applications using vulnerable versions of the library.
Technical details
The vulnerability is a property access control bypass (CWE-88) in math.js versions before 3.17.0. Attackers could replace forbidden properties such as the constructor by using unicode lookalike characters when creating objects, bypassing the library's security checks. The attack is network-reachable and requires no authentication or user interaction if the application parses untrusted mathematical expressions via math.js. No known public exploits existed at the time of disclosure, though the vulnerability could potentially lead to arbitrary code execution. The fix was released in version 3.17.0 on 2017-11-18.
Affected products
- Jos de Jong mathjs before 3.17.0
Timeline
- 2017-12-18: disclosed
- 2017-11-18: patched: Fix released in version 3.17.0