Executive brief
Qwik is a modern JavaScript framework used to build web applications. The PureFunctionSerializer feature allowed arbitrary JavaScript code to be executed on the server side without proper validation, enabling attackers to run malicious code and compromise the server. This vulnerability affects all versions prior to 0.21.0 and has been fixed by removing the vulnerable serializer.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the PureFunctionSerializer component of Qwik's deserialization logic. The pureServerFunction feature exposed the Function deserializer, which used unsafe deserialization via the JavaScript Function constructor (new Function()) to recreate functions from serialized data. This allowed an unauthenticated network attacker to craft malicious serialized function data that would be executed by Node.js on the server with no preconditions. An attacker could achieve complete remote code execution. The fix, released in version 0.21.0, involved removing the PureFunctionSerializer entirely.
Affected products
- BuilderIO Qwik prior to 0.21.0
Timeline
- 2023-03-09: disclosed: Published on GitHub Advisory Database
- 2023-03-03: patched: Fixed in version 0.21.0 by removing PureFunctionSerializer
- 2023-03-08: other: NVD publication date