swagger-api / swagger-api/swagger-codegen

CVE-2019-10747 (High) detected in set-value-0.4.3.tgz, set-value-2.0.0.tgz

Open
#11,485 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

security vulnerability
Dominant language
Mustache
Stars
17.8k
Forks
6k
PR merge metrics
No merged PRs in 30d

Description

CVE-2019-10747 - High Severity Vulnerability

Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /samples/client/petstore/javascript-es6/package.json

Path to vulnerable library: /samples/client/petstore/javascript-es6/node_modules/union-value/node_modules/set-value/package.json,/samples/client/petstore/javascript-promise-es6/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • base-0.11.2.tgz
              • cache-base-1.0.1.tgz
                • union-value-1.0.0.tgz
                  • set-value-0.4.3.tgz (Vulnerable Library)
set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /samples/client/petstore/javascript-es6/package.json

Path to vulnerable library: /samples/client/petstore/javascript-es6/node_modules/set-value/package.json,/samples/client/petstore/javascript-promise-es6/node_modules/set-value/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • base-0.11.2.tgz
              • cache-base-1.0.1.tgz
                • set-value-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed

Found in base branch: master

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-10-29

Fix Resolution: 2.0.1,3.0.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the package.json files under samples/client/petstore/javascript-es6 and samples/client/petstore/javascript-promise-es6, then trace the dependency paths listed in the issue. Update the vulnerable set-value versions to a fixed release and verify that a dependency scan no longer reports CVE-2019-10747.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.