GHSA-97r2-qh9m-474h: High severity npm/seroval vulnerability
Summary
fromJSON and fromCrossJSON used two node fields without checking them.
- An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished.
Impact
A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.
- The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever.
Patches
Fixed in seroval@1.6.8.
- Element lists must be arrays. - A sequence node's throw and done indices must be integers from -1 up to the last element index.
Invalid input throws SerovalMalformedNodeError.
Workarounds
None. Upgrade to 1.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/serovalto a version that resolves this vulnerability.Fixed in 1.6.8 - Upgrade
Upgrade
serovalto a version that resolves this vulnerability.Fixed in 1.6.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Services are exposed if they pass untrusted input to seroval's fromJSON or fromCrossJSON functions. An unauthenticated request can trigger the issue when it reaches either decoder.
What is required to exploit the issue?
The attacker needs to supply a crafted node to a reachable decoder. In the array case, the payload can cause the decoder loop to block the thread; in the sequence case, code that consumes the resulting iterator to completion can run indefinitely.
What can be done if an immediate patch is not possible?
No workaround is provided. Upgrade seroval to version 1.6.8, which rejects malformed element lists and invalid sequence throw or done indices with SerovalMalformedNodeError.