Quick answers
- Is CVE-2023-1283 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-1283 being exploited in the wild.
- How severe is CVE-2023-1283?
- Low severity, with a CVSS score of 3.1, published 9 March 2023.
- Which products and versions are affected?
- @builder.io/qwik (npm) SEMVER:introduced=0,fixed=0.21.0.
- Is there a fix for CVE-2023-1283?
- Yes. @builder.io/qwik (npm): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-1283 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2023-1283?
- Check whether you run @builder.io/qwik (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @builder.io/qwik (npm): upgrade to 0.21.0 or later
npm install @builder.io/qwik@0.21.0
Technical details
The vulnerability is a code injection flaw (CWE-94) in the PureFunctionSerializer component of Qwik's deserialization logic. The pureServerFunction feature exposed the Function deserializer, which used unsafe deserialization via the JavaScript Function constructor (new Function()) to recreate functions from serialized data. This allowed an unauthenticated network attacker to craft malicious serialized function data that would be executed by Node.js on the server with no preconditions. An attacker could achieve complete remote code execution. The fix, released in version 0.21.0, involved removing the PureFunctionSerializer entirely.
Affected products
- BuilderIO Qwik prior to 0.21.0
Identifiers
- CVE-2023-1283
- GHSA-9wf9-qvvp-2929
Timeline
- 2023-03-09: disclosed: Published on GitHub Advisory Database
- 2023-03-03: patched: Fixed in version 0.21.0 by removing PureFunctionSerializer
- 2023-03-08: other: NVD publication date