GHSA-7rv5-mrxv-xcr9: High severity npm/seroval vulnerability
Summary
When fromJSON rebuilt an async iterator, it called on() on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's on method.
This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node.
Impact
An application that passes untrusted input to fromJSON with plugins that return callable values can have those callables invoked during deserialization. What this allows depends on what the plugin's values do.
Affected versions
- Versions up to 1.6.3 accept any value as the source. - 1.6.4 rejects the reported payload. - 1.6.5 to 1.6.7 check the source by node type, which a payload can get around by reusing a node id. - All versions up to 1.6.7 should be treated as affected.
Patches
Fixed in seroval@1.6.8. Streams and sequences are now internal class instances. The deserializer checks the source value with instanceof, so plain data and plugin values are rejected no matter which node id they use.
Workarounds
Avoid plugins whose deserialize returns functions or objects with an on method when decoding untrusted input. Upgrading to 1.6.8 is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/serovalto a version that resolves this vulnerability.Fixed in 1.6.8 - Upgrade
Upgrade
serovalto a version that resolves this vulnerability.Fixed in 1.6.8 - Compensating control
Avoid plugins whose deserialize returns functions or objects with an on method when decoding untrusted input.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications are exposed when they pass untrusted input to fromJSON and use plugins that return callable values. The impact depends on what those callable plugin values do when invoked.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted deserialization payload that selects another value, such as a callable returned by an application plugin, as an async iterator source. During deserialization, the vulnerable code can call that value's on method.
Which seroval versions should be remediated?
All versions through 1.6.7 should be treated as affected. Version 1.6.4 rejects the reported payload, but versions 1.6.5 through 1.6.7 can be bypassed through node ID reuse; the fix is seroval 1.6.8.
How does the fixed version prevent the issue?
In 1.6.8, streams and sequences are internal class instances and the deserializer validates the source with instanceof. This rejects plain data and plugin-provided values regardless of the node ID used.