Vulnerability-Lookup

GHSA-34R7-Q49F-H37C

Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2021-10-29 14:15

Summary

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Details

Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

Recommendation

Upgrade UglifyJS to version >= 2.4.24.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uglify-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "uglifier"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-8857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1254",
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:00Z",
    "nvd_published_at": "2017-01-23T21:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.\n\n## Recommendation\n\nUpgrade UglifyJS to version \u003e= 2.4.24.",
  "id": "GHSA-34r7-q49f-h37c",
  "modified": "2021-10-29T14:15:03Z",
  "published": "2017-10-24T18:33:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8857"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mishoo/UglifyJS2/issues/751"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mishoo/UglifyJS2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410"
    },
    {
      "type": "WEB",
      "url": "https://zyan.scripts.mit.edu/blog/backdooring-js"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js"
}

CVE-2015-8857 (GCVE-0-2015-8857)

Vulnerability from cvelistv5 – Published: 2017-01-23 21:00 – Updated: 2024-08-06 08:29

Summary

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
http://www.securityfocus.com/bid/96410	vdb-entryx_refsource_BID
https://nodesecurity.io/advisories/39	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/0…	mailing-listx_refsource_MLIST

Date Public

2015-08-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:22.084Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96410",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96410"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodesecurity.io/advisories/39"
          },
          {
            "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-01T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "96410",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96410"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodesecurity.io/advisories/39"
        },
        {
          "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8857",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96410",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96410"
            },
            {
              "name": "https://nodesecurity.io/advisories/39",
              "refsource": "CONFIRM",
              "url": "https://nodesecurity.io/advisories/39"
            },
            {
              "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8857",
    "datePublished": "2017-01-23T21:00:00.000Z",
    "dateReserved": "2016-04-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:29:22.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GSD-2015-8857

Vulnerability from gsd - Updated: 2015-07-21 00:00

Details

The upstream library for the Ruby uglifier gem, UglifyJS, is affected by a vulnerability that allows a specially crafted Javascript file to have altered functionality after minification. This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated to allow potentially malicious code to be hidden within secure code, and activated by the minification process. For more information, consult: * https://zyan.scripts.mit.edu/blog/backdooring-js * CWE: 254 - 7PK - Security Features

Aliases

CVE-2015-8857

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2015-8857",
    "description": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.",
    "id": "GSD-2015-8857",
    "references": [
      "https://www.suse.com/security/cve/CVE-2015-8857.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "uglifier",
            "purl": "pkg:gem/uglifier"
          }
        }
      ],
      "aliases": [
        "CVE-2015-8857",
        "OSVDB-126747",
        "GHSA-34r7-q49f-h37c"
      ],
      "details": "\nThe upstream library for the Ruby uglifier gem, UglifyJS, is\naffected by a vulnerability that allows a specially crafted\nJavascript file to have altered functionality after minification.\n\nThis bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated\nto allow potentially malicious code to be hidden within secure code,\nand activated by the minification process.\n\nFor more information, consult:\n* https://zyan.scripts.mit.edu/blog/backdooring-js\n\n* CWE: 254 - 7PK - Security Features\n",
      "id": "GSD-2015-8857",
      "modified": "2015-07-21T00:00:00.000Z",
      "published": "2015-07-21T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/mishoo/UglifyJS2/issues/751"
        },
        {
          "type": "WEB",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8857"
        },
        {
          "type": "WEB",
          "url": "https://github.com/mishoo/UglifyJS/issues/751"
        },
        {
          "type": "WEB",
          "url": "https://blog.azuki.vip/backdooring-js"
        },
        {
          "type": "WEB",
          "url": "https://www.openwall.com/lists/oss-security/2016/04/20/11"
        },
        {
          "type": "WEB",
          "url": "https://github.com/advisories/GHSA-34r7-q49f-h37c"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V2"
        },
        {
          "score": 9.8,
          "type": "CVSS_V3"
        }
      ],
      "summary": "uglifier incorrectly handles non-boolean comparisons during minification"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2015-8857",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "96410",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/96410"
          },
          {
            "name": "https://nodesecurity.io/advisories/39",
            "refsource": "CONFIRM",
            "url": "https://nodesecurity.io/advisories/39"
          },
          {
            "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2015-8857",
      "cvss_v2": 7.5,
      "cvss_v3": 9.8,
      "date": "2015-07-21",
      "description": "\nThe upstream library for the Ruby uglifier gem, UglifyJS, is\naffected by a vulnerability that allows a specially crafted\nJavascript file to have altered functionality after minification.\n\nThis bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated\nto allow potentially malicious code to be hidden within secure code,\nand activated by the minification process.\n\nFor more information, consult:\n* https://zyan.scripts.mit.edu/blog/backdooring-js\n\n* CWE: 254 - 7PK - Security Features\n",
      "gem": "uglifier",
      "ghsa": "34r7-q49f-h37c",
      "osvdb": 126747,
      "patched_versions": [
        "\u003e= 2.7.2"
      ],
      "related": {
        "url": [
          "https://nvd.nist.gov/vuln/detail/CVE-2015-8857",
          "https://github.com/mishoo/UglifyJS/issues/751",
          "https://blog.azuki.vip/backdooring-js",
          "https://www.openwall.com/lists/oss-security/2016/04/20/11",
          "https://github.com/advisories/GHSA-34r7-q49f-h37c"
        ]
      },
      "title": "uglifier incorrectly handles non-boolean comparisons during minification",
      "url": "https://github.com/mishoo/UglifyJS2/issues/751"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.7.2",
          "affected_versions": "All versions before 2.7.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-254",
            "CWE-937"
          ],
          "date": "2023-03-27",
          "description": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.",
          "fixed_versions": [
            "2.7.2"
          ],
          "identifier": "CVE-2015-8857",
          "identifiers": [
            "GHSA-34r7-q49f-h37c",
            "CVE-2015-8857"
          ],
          "not_impacted": "All versions starting from 2.7.2",
          "package_slug": "gem/uglifier",
          "pubdate": "2017-10-24",
          "solution": "Upgrade to version 2.7.2 or above.",
          "title": "Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2015-8857",
            "https://github.com/mishoo/UglifyJS2/issues/751",
            "https://zyan.scripts.mit.edu/blog/backdooring-js/",
            "http://www.openwall.com/lists/oss-security/2016/04/20/11",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml",
            "https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410",
            "https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e",
            "https://github.com/advisories/GHSA-34r7-q49f-h37c"
          ],
          "uuid": "1194a94c-0a0b-4e24-86ed-47bfa4c1233d"
        },
        {
          "affected_range": "\u003c2.4.24",
          "affected_versions": "All versions before 2.4.24",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-254",
            "CWE-937"
          ],
          "date": "2021-10-29",
          "description": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.",
          "fixed_versions": [
            "2.4.24"
          ],
          "identifier": "CVE-2015-8857",
          "identifiers": [
            "GHSA-34r7-q49f-h37c",
            "CVE-2015-8857"
          ],
          "not_impacted": "All versions starting from 2.4.24",
          "package_slug": "npm/uglify-js",
          "pubdate": "2017-10-24",
          "solution": "Upgrade to version 2.4.24 or above.",
          "title": "Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2015-8857",
            "https://github.com/mishoo/UglifyJS2/issues/751",
            "https://github.com/advisories/GHSA-34r7-q49f-h37c",
            "https://www.npmjs.com/advisories/39",
            "https://zyan.scripts.mit.edu/blog/backdooring-js/",
            "https://nodesecurity.io/advisories/39",
            "http://www.openwall.com/lists/oss-security/2016/04/20/11",
            "http://www.securityfocus.com/bid/96410"
          ],
          "uuid": "61e418d9-8b84-425a-bb44-88fd81a505f3"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:uglifyjs_project:uglifyjs:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.4.24",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8857"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-254"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodesecurity.io/advisories/39",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/39"
            },
            {
              "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
            },
            {
              "name": "96410",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/96410"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-10-28T15:05Z",
      "publishedDate": "2017-01-23T21:59Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-34R7-Q49F-H37C

Recommendation

CVE-2015-8857 (GCVE-0-2015-8857)

GSD-2015-8857

Tags

Sightings

Nomenclature

Related by attack behaviour