Junglewise Threat Intelligence

CVE-2017-1001004: typed-function arbitrary JavaScript execution via function name injection

CVE-2017-1001004 · Severity: info · CVSS 8.8 · Published 2020-09-02

Vendors: npm.

Executive brief

typed-function is a JavaScript library used to handle type-checking and function overloading. A security flaw in versions prior to 0.10.6 allows for the execution of unauthorized code if an attacker can influence the name assigned to a function. This could lead to a complete compromise of the application, including data theft or unauthorized system access.

Technical details

The typed-function library is vulnerable to arbitrary code execution (CWE-94) in versions prior to 0.10.6. The vulnerability stems from improper sanitization of the function name parameter during the creation of a typed function. Because the library dynamically generates code to create these functions, an attacker who can control the function name string can inject and execute arbitrary JavaScript code within the engine's context. While the attack vector is listed as network-based, it typically requires user interaction or a specific application flow where untrusted input is used to define function metadata. The issue was addressed in version 0.10.6 by implementing proper input validation and sanitization.

Affected products

  • josdejong typed-function < 0.10.6

Timeline

  • 2017-11-18: patched: Version 0.10.6 released to fix the issue.
  • 2017-11-27: disclosed: Vulnerability publicly disclosed.
  • 2020-09-02: advisory: GitHub advisory published.

References