Executive brief
serialize-to-js is a JavaScript library used to deserialize data structures from strings. The library's deserialize function fails to properly validate input, allowing attackers to execute arbitrary code by injecting an Immediately Invoked Function Expression (IIFE). This can lead to complete compromise of any application using this library to process untrusted data.
Technical details
The vulnerability is a deserialization code execution flaw (CWE-502) in the serialize-to-js library's deserialize() function. The root cause is unsafe use of new Function() to parse serialized data, which allows injection of function expressions that execute immediately. An attacker can craft a malicious serialized payload containing an IIFE (e.g., "(function(){ eval('...')})()") that executes arbitrary JavaScript code when deserialized. No authentication or user interaction is required—only network access to send untrusted data to an application using the vulnerable library. The vulnerability was fixed in version 1.0.0 and later.
Affected products
- commenthol serialize-to-js before 1.0.0
Timeline
- 2017-02-09: disclosed
- 2017: patched: Fixed in version 1.0.0
- 2018-07-18: advisory