Executive brief
node-serialize is a Node.js library used to serialize and deserialize JavaScript objects. The library is vulnerable to remote code execution when untrusted data is passed to the unserialize() function, allowing attackers to execute arbitrary code on systems using the affected versions. This could lead to complete compromise of systems relying on the library for data processing.
Technical details
The vulnerability is an unsafe deserialization flaw (CWE-502) in node-serialize's unserialize() function. The root cause is the use of eval() to process serialized data, which allows attackers to inject and execute arbitrary code through immediately invoked function expressions (IIFE). An attacker can craft a malicious serialized string containing JavaScript code that executes when deserialization occurs. No network authentication is required; the vulnerability is triggered whenever untrusted user input is processed via unserialize(). The package author has not released a patch and recommends mitigating controls such as cryptographic signing of serialized data or network isolation rather than fixing the underlying design flaw.
Affected products
- npm node-serialize all versions through 0.0.4
Timeline
- 2017-02-09: disclosed: Initial disclosure via GitHub issue
- 2018-07-18: advisory: GitHub Security Advisory published