Quick answers
- Is CVE-2024-54152 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-54152 being exploited in the wild.
- How severe is CVE-2024-54152?
- Medium severity, with a CVSS score of 4, published 10 December 2024.
- Which products and versions are affected?
- Peerigon Angular-Expressions <=1.4.2.
- Is there a fix for CVE-2024-54152?
- A patch was published on 2024-12-10: Version 1.4.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-54152 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-54152?
- Check whether you run Peerigon Angular-Expressions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a sandbox escape (CWE-94) in the angular-expressions library that occurs when expressions are compiled with the locals parameter (two-argument function call). An attacker can craft a malicious expression such as `__proto__.constructor` that accesses the prototype chain, which should return undefined but instead returns an object in vulnerable versions. This allows escape from the expression sandbox and leads to arbitrary code execution. The root cause is insufficient filtering of prototype chain access when locals are provided. The attack is unauthenticated and requires only the ability to pass an expression string to the compile() function with locals enabled. The vulnerability was patched in version 1.4.3 by explicitly disallowing prototype chain access in two-argument function calls.
Affected products
- peerigon angular-expressions <=1.4.2
Identifiers
- CVE-2024-54152
- GHSA-5462-4vcx-jh7j
Timeline
- 2024-12-10: disclosed
- 2024-12-10: patched: Version 1.4.3 released with fix