Executive brief
total.js is a Node.js web framework used to build server-side applications. The framework's utility functions U.set() and U.get() are vulnerable to code injection, allowing an attacker to execute arbitrary code on the server without authentication. This could lead to complete compromise of the application and underlying system.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the U.set() and U.get() utility functions within total.js before version 3.4.9. These functions fail to properly sanitize user-controlled input, allowing attackers to inject and execute arbitrary code. The attack requires network access to the affected application but does not require authentication or user interaction. A successful exploit results in arbitrary code execution with the privileges of the application process. The vulnerability was patched in version 3.4.9, with the fix committed to the framework's repository.
Affected products
- total.js total.js before 3.4.9
Timeline
- 2021-07-12: disclosed
- 2021-12-10: advisory
- 2021: patched: Fixed in version 3.4.9