Description

Node.js package node-serialize versions <=0.0.4 are vulnerable to a insecure deserialization vulnerability that can be escalated to remote code execution by passing a serialized JavaScript Object with an Immediately invoked function expression (IIFE).

Remediation

Untrusted user input should not be passed to the unserialize() function.

References

Exploiting Node.js deserialization bug for Remote Code Execution

Related Vulnerabilities

WordPress Plugin Product Table by WBW Remote Code Execution (2.0.1)

WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (4.2997)

WordPress Plugin WordPress Mega Menu-QuadMenu Remote Code Execution (2.0.6)

WordPress Plugin Form Manager Remote Command Execution (1.7.2)

WordPress Plugin Include Me Remote Code Execution (1.2.1)

Severity

High

Classification

CVE-2017-5941 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A

Tags

Abuse Of Functionality Code Execution Insecure Deserialization