Executive brief
Synchrony is a JavaScript deobfuscator tool used by developers to reverse-engineer obfuscated code. A prototype pollution vulnerability in its LiteralMap transformer allows an attacker to inject malicious code that executes arbitrary commands when the tool processes a crafted input file, potentially compromising systems where the deobfuscator runs.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the LiteralMap transformer of Synchrony versions 2.0.1 through 2.4.3. The flaw allows an attacker to inject a __proto__ property via crafted JavaScript input. When Synchrony runs in Node.js, it uses the prettier module which attempts to load a parser; an attacker can set the parser property on __proto__ to point to a malicious JavaScript file on disk, causing Node.js to require() and execute that file. Attack requires local file access and the ability to place a malicious file in the filesystem, but requires no privileges or user interaction. The vulnerability was patched in deobfuscator@2.4.4.
Affected products
- relative Synchrony >=2.0.1, <2.4.4
Timeline
- 2023-10-17: disclosed
- 2023-10-18: patched: Fixed in deobfuscator@2.4.4