CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator
Prototype pollution in the Synchrony deobfuscator library allows attackers to execute arbitrary code via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45811?
CVE-2023-45811 is a high-severity code injection vulnerability in relative synchrony, published on 17 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `[email protected]`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags
Weakness: CWE-1321
Which versions are affected by CVE-2023-45811?
2 open source packages ship an affected version, including deobfuscator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
deobfuscator npm | From 2.0.1 | 2.4.4 |
deobfuscator npm | From 2.0.1 | 2.4.4 |
Products include Relative Synchrony.
How do I fix CVE-2023-45811?
Upgrade deobfuscator to 2.4.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-45811 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45811 exists.
Sources
Also known as GHSA-jg82-xh3w-rhxx.