Executive brief
node-stringbuilder is a JavaScript library that provides efficient string manipulation. The library contains a memory access vulnerability that allows an attacker to read previously allocated memory by calling methods like ToBuffer, ToString, or CharAt with negative indices. This could expose sensitive data such as encryption keys, credentials, or other confidential information that was previously stored in memory.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) caused by incorrect memory length calculation in the native C++ code. When ToBuffer, ToString, or CharAt methods are called on a StringBuilder object with non-empty string input, insufficient bounds checking allows negative indices or other malformed parameters to cause reads beyond the allocated buffer. The attack is network-accessible if the vulnerable library is used in a server application, requires no authentication or user interaction, and allows an attacker to leak previously freed memory. The vulnerability affects all versions up to and including 2.2.7; patch status is unknown from the advisory.
Affected products
- magiclen node-stringbuilder up to 2.2.7
Timeline
- 2024-01-15: disclosed: Vulnerability discovered and reported
- 2024-07-10: advisory: GitHub Advisory GHSA-g533-xq5w-jmf3 published