Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 20 October 2022.

Which products and versions are affected?

ses (npm) SEMVER:introduced=0,fixed=0.16.0.

Is there a fix for This vulnerability?

Yes. ses (npm): upgrade to 0.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access.

Check whether you run ses (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SES TypedArray hardening bypass with non-canonical numeric properties

Severity: info · Published 2022-10-20

SES is a JavaScript library that hardens objects to enable safe sharing between untrusted code segments (co-tenant programs). A defect in the hardening of TypedArray objects allowed properties with non-canonical numeric names (like "+0" instead of "0") to remain writable, enabling co-tenant programs to tamper with each other's APIs or exchange data they shouldn't be able to access.

Technologies: ses (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 20 October 2022.
Which products and versions are affected?: ses (npm) SEMVER:introduced=0,fixed=0.16.0.
Is there a fix for This vulnerability?: Yes. ses (npm): upgrade to 0.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access.
Am I affected?: Check whether you run ses (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ses (npm): upgrade to 0.16.0 or later
```
npm install ses@0.16.0
```

Technical details

The vulnerability is a logic error in the harden() function's handling of TypedArray properties. The harden function is designed to make non-indexed properties non-writable and non-configurable on TypedArrays, while allowing indexed properties (which hold numeric content) to remain mutable. However, the implementation failed to recognize and lock down properties with non-canonical numeric representations (e.g., "+0", "" which both parse to the number 0), leaving them writable and configurable. An attacker with access to a hardened TypedArray shared between co-tenant programs could use these non-canonical property names as a covert side-channel for API pollution attacks or arbitrary object communication. The vulnerability affects SES versions prior to 0.16.0, which introduced proper validation of non-integer numeric property names. Network reachability is not a factor; exploitation requires the attacker to have a reference to the shared TypedArray and the ability to execute code in a co-tenant context.

Affected products

Agoric SES <0.16.0

Timeline

2022-10-19: disclosed
2022-10-20: patched: SES 0.16.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.