Executive brief
Nadesiko3 is a programming language environment with an editor component (nako3edit). A remote attacker can send specially crafted input that triggers improper exception handling in the URI decoder, causing the server to crash. This creates a denial of service vulnerability affecting availability of systems running affected versions.
Technical details
Nako3edit in nadesiko3 v3.3.74 and earlier contains improper exception handling (CWE-703, CWE-755) in the decodeURIComponent function. An unauthenticated remote attacker can send invalid URI-encoded values over the network without any special privileges, causing an uncaught exception that crashes the server. The vulnerability has been patched in version 3.3.75. The root cause is insufficient validation and error handling of malformed input passed to the decodeURIComponent decoder.
Affected products
- kujirahand nadesiko3 3.3.74 and earlier
Timeline
- 2022-12-05: disclosed: GHSA-x2jx-w3wm-9p3p and CVE-2022-41777 published
- 2022: patched: Fixed in version 3.3.75