Executive brief
node-weakauras-parser is a Node.js library that encodes and decodes data structures used by the World of Warcraft addon WeakAuras. A buffer overflow vulnerability in the encode_weakaura function fails to validate input size properly, allowing specially crafted inputs to trigger a crash or potentially arbitrary code execution. Applications using affected versions of this library may experience denial of service or be exploited if processing untrusted data.
Technical details
The vulnerability is a CWE-120 buffer overflow in the encode_weakaura function, which fails to properly validate input size before buffer operations. A malformed input buffer of 13835058055282163711 bytes triggers a usize (unsigned integer) overflow on 64-bit systems. The function accepts DEFLATE-compressed input, so exploitation requires providing specially crafted compressed data. The attack requires the application to process untrusted or adversary-controlled encoded payloads. Patches were released in versions 1.0.5, 2.0.2, and 3.0.1, which added proper overflow checking.
Affected products
- Zireael-N node-weakauras-parser 1.0.4, 2.0.0–2.0.1, 3.0.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: patched: Fix committed before public disclosure