GHSA-7cgc-fjv4-52x6 Malware in pre-build binaries of bignum
Malicious binaries served from an expired S3 bucket allow attackers to execute code and exfiltrate data from users installing the bignum library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7cgc-fjv4-52x6?
GHSA-7cgc-fjv4-52x6 is a vulnerability in bignum, published on 24 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
bignum releases from v0.12.2 to v0.13.0 (inclusive) used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party which is now serving binaries containing malware that exfiltrates data from the user's computer.
Patches
v0.13.1 does not use node-pre-gyp and does not have support for downloading pre-built binaries in any form, avoiding the risk of malicious downloads.
Which versions are affected by GHSA-7cgc-fjv4-52x6?
2 open source packages ship an affected version, including bignum.
| Package | Affected | Fixed in |
|---|---|---|
bignum npm | From 0.12.2 | 0.13.1 |
bignum npm | From 0.12.2 | 0.13.1 |
How do I fix GHSA-7cgc-fjv4-52x6?
Upgrade bignum to 0.13.1 or later.
Is GHSA-7cgc-fjv4-52x6 being exploited?
There is no known exploitation of GHSA-7cgc-fjv4-52x6 in the wild and no public exploit code.