CVE-2022-21122

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd	Patch Third Party Advisory
https://github.com/metarhia/metacalc/pull/16	Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-METACALC-2826197	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:metarhia:metacalc:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-06-08 09:15

Updated : 2022-06-17 00:59

NVD link : CVE-2022-21122

Mitre link : CVE-2022-21122

CVE.ORG link : CVE-2022-21122

JSON object : View

Products Affected

metarhia

metacalc

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2022-21122", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2022-06-08T09:15:08.470", "references": [{"url": "https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/metarhia/metacalc/pull/16", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-METACALC-2826197", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor."}, {"lang": "es", "value": "El paquete metacalc versiones anteriores a 0.0.2, es vulnerable a una ejecuci\u00f3n arbitraria de c\u00f3digo cuando expone la clase Math de JavaScript al contexto v8. Como la clase Math est\u00e1 expuesta al contexto del usuario, puede ser usada para conseguir acceso al constructor de funciones de JavaScript"}], "lastModified": "2022-06-17T00:59:22.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:metarhia:metacalc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "515FDC04-65C9-4337-ADFB-BFBC356A2DE1", "versionEndExcluding": "0.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}