Executive brief
javascript-deobfuscator is a JavaScript deobfuscation tool used by developers and security researchers to reverse obfuscation techniques. Crafted payloads targeting the expression simplification feature can bypass validation and execute arbitrary code with the same privileges as the tool operator.
Technical details
The vulnerability is an improper neutralization of input during expression simplification (CWE-94: Improper Control of Generation of Code). When processing obfuscated JavaScript, the tool's expression simplification feature evaluates untrusted payloads without proper sanitization, allowing an attacker to craft input such as !'hello\\"+alert(`Hello World`)//"' that results in arbitrary code execution. Attack vector is local; an attacker must provide a malicious JavaScript file to the tool for processing. The vulnerability affects all versions prior to 1.1.0, which has been patched. The tool must be run by a user, but no user interaction beyond opening a file is required.
Affected products
- Ben Pottinger javascript-deobfuscator <1.1.0
Timeline
- 2024-05-31: disclosed
- 2024-06-04: patched: Version 1.1.0 released