Executive brief
replicator is a JavaScript library used for cloning and deserializing complex data structures. The library's TypedArray deserialization function allows remote attackers to execute arbitrary code by providing specially crafted serialized input, potentially leading to complete system compromise.
Technical details
A deserialization flaw exists in the fromSerializable function of replicator's TypedArray handler (CWE-502). The vulnerable code instantiates arbitrary constructors during deserialization without proper validation. An unauthenticated attacker can send malicious serialized data over the network to an application using the replicator.decode() method, chaining constructor calls (e.g., Function → setTimeout → exec) to achieve arbitrary code execution. The vulnerability affects all versions before 1.0.4, which implements proper validation to prevent unsafe constructor invocation.
Affected products
- inikulin replicator before 1.0.4
Timeline
- 2021-05-14: disclosed: Issue #16 opened on GitHub
- 2021: patched: Fix released in version 1.0.4
- 2022-12-15: advisory: GitHub advisory GHSA-hw46-vg6w-88fj published