Executive brief
mosc is a Node.js library for building object models from inline properties. The library fails to safely process user-supplied property strings, instead executing them directly with JavaScript's eval() function. An attacker can exploit this to execute arbitrary code with the privileges of the application running mosc, potentially leading to data theft, system compromise, or lateral movement.
Technical details
mosc through version 1.0.0 contains a code injection vulnerability in the parse_properties() method. User input passed to the properties argument is executed directly via eval() without sanitization or validation (CWE-94). The vulnerability requires network access to an application using mosc, but no authentication or user interaction. An attacker can craft a malicious properties string to execute arbitrary JavaScript code, including filesystem operations, command execution, and data exfiltration. No patched version exists; the library is unmaintained.
Affected products
- mosc mosc through 1.0.0
Timeline
- 2020-06-05: disclosed
- 2021-05-17: advisory