Description

Node.js package node-serialize versions <=0.0.4 are vulnerable to a insecure deserialization vulnerability that can be escalated to remote code execution by passing a serialized JavaScript Object with an Immediately invoked function expression (IIFE).

Remediation

Untrusted user input should not be passed to the unserialize() function.

References

Exploiting Node.js deserialization bug for Remote Code Execution

Related Vulnerabilities

Spring Data REST RCE via PATCH requests

Unauthenticated OGNL injection in Confluence Server and Data Center

Java Debug Wire Protocol remote code execution

Oracle Sun GlassFish/Java System Application Server Remote Authentication Bypass Vulnerability

WordPress Plugin is_human() 'type' Parameter Remote Command Injection (1.4.2)

Severity

High

Classification

CVE-2017-5941 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A

Tags

Abuse Of Functionality Code Execution Insecure Deserialization