CVE-2023-30857 @aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decorator
Prototype pollution in @aedart/support allows attackers to modify object prototypes via metadata merging, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30857?
CVE-2023-30857 is a low-severity vulnerability in aedart ion, published on 28 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.
Weakness: CWE-1321
Which versions are affected by CVE-2023-30857?
2 open source packages ship an affected version, including @aedart/support. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@aedart/support npm | All versions | 0.6.1 |
@aedart/support npm | All versions | 0.6.1 |
Products include Aedart Ion.
How do I fix CVE-2023-30857?
Upgrade @aedart/support to 0.6.1 or later.
Is CVE-2023-30857 being exploited?
There is no known exploitation of CVE-2023-30857 in the wild and no public exploit code.
Sources
Also known as GHSA-wwxh-74fx-33c6.