CVE-2024-21524 node-stringbuilder vulnerable to Out-of-bounds Read
Attackers can read previously allocated memory by providing negative indexes to string builder methods, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21524?
CVE-2024-21524 is a high-severity vulnerability in node-stringbuilder, published on 10 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.
Weakness: CWE-125
Which versions are affected by CVE-2024-21524?
2 open source packages ship an affected version, including node-stringbuilder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-stringbuilder npm | All versions to 2.2.7 | None |
node-stringbuilder npm | All versions to 2.2.7 | None |
Products include Magiclen Stringbuilder.
How do I fix CVE-2024-21524?
No fix has been published for CVE-2024-21524 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-21524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21524 exists.
Sources
Also known as GHSA-g533-xq5w-jmf3.