GHSA-2x86-cf3f-86gw: sync-rpc: Arbitrary remote code execution vulnerability
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sync-rpcto a version that resolves this vulnerability.Fixed in 1.3.7
Event History
Frequently Asked Questions
What conditions must be present for exploitation?
The attacker must be able to guess the correct port and reach it over the network. Exploitation is prevented when that port is blocked by a firewall.
Which deployments are exposed?
Deployments using sync-rpc versions before 1.3.7 may be exposed if the sync-rpc port is network-accessible. The issue allows execution of arbitrary JavaScript files that are already stored on the server.
What can be done if upgrading is not immediately possible?
Block access to the relevant sync-rpc port with a firewall. This removes the network reachability condition described for exploitation.
How can I remediate the issue?
Upgrade sync-rpc to version 1.3.7 or later, which includes the patch.