Is CVE-2019-18954 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-18954 being exploited in the wild.

How severe is CVE-2019-18954?

Low severity, with a CVSS score of 3.1, published 2 December 2019.

Which products and versions are affected?

pomelo (npm) SEMVER:introduced=0,fixed=2.2.7.

Is there a fix for CVE-2019-18954?

Yes. pomelo (npm): upgrade to 2.2.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-18954 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-18954?

Check whether you run pomelo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-18954: Pomelo critical state manipulation via attribute injection

CVE-2019-18954 · Severity: low · CVSS 3.1 · Published 2019-12-02

Pomelo is a scalable game server framework for Node.js. An unauthenticated remote attacker can inject malicious attributes into user input to overwrite internal handler methods and attributes, allowing them to corrupt or disable game server functionality. For example, an attacker could overwrite the login handler to prevent all users from accessing the game server.

Vendors: npm.

Quick answers

Is CVE-2019-18954 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-18954 being exploited in the wild.
How severe is CVE-2019-18954?: Low severity, with a CVSS score of 3.1, published 2 December 2019.
Which products and versions are affected?: pomelo (npm) SEMVER:introduced=0,fixed=2.2.7.
Is there a fix for CVE-2019-18954?: Yes. pomelo (npm): upgrade to 2.2.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-18954 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-18954?: Check whether you run pomelo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pomelo (npm): upgrade to 2.2.7 or later
```
npm install pomelo@2.2.7
```

Technical details

The vulnerability is a CWE-668 (Exposure of Resource to Wrong Sphere) issue in Pomelo's entry handler (template/game-server/app/servers/connector/handler/entryHandler.js). The root cause is improper input validation and object property assignment—the handler fails to sanitize user input, allowing attackers to inject properties that overwrite critical handler methods. The attack is network-accessible (no authentication required) and requires no user interaction. An unauthenticated remote attacker can send a crafted request (e.g., via the connector RPC interface) with nested properties targeting the handler's constructor or methods, causing method overwriting and handler malfunction. The vulnerability was fixed in Pomelo v2.2.7; versions through 2.2.5 are affected.

Affected products

NetEase pomelo < 2.2.7

Identifiers

CVE-2019-18954
GHSA-4x6v-rwh4-55jw

Timeline

2019-12-02: disclosed
2019: patched: Fixed in version 2.2.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.