CVE-2019-10805: valib - Exposure of Resource to Wrong Sphere
Summary
CVE-2019-10805: Exposure of Resource to Wrong Sphere in valib. Affects valib versions < 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
valib is an npm package that provides inspection functions for JavaScript objects. It allows developers to examine objects and perform security checks. However, versions up to 2.0.0 of valib are vulnerable to Internal Property Tampering. This vulnerability enables a maliciously crafted JavaScript object to bypass several inspection functions provided by valib. By manipulating the inspection results, an attacker can bypass security checks and potentially exploit the application.
Vulnerability Detail
The vulnerability in valib arises from the use of the built-in function 'hasOwnProperty' from unsafe user-input to examine an object. A crafted payload can overwrite this function, allowing the attacker to manipulate the inspection results. This enables them to bypass security checks and potentially gain unauthorized access or perform other malicious actions. The severity of this vulnerability is rated as MODERATE with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to update the valib package to the latest version to address the issue.
Conclusion
In conclusion, the valib package up to version 2.0.0 is vulnerable to Internal Property Tampering. It is crucial to update the package to the latest version to mitigate the risk of unauthorized access and other malicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for valib →
FAQ
valib is an npm package that provides inspection functions for JavaScript objects.
This vulnerability allows an attacker to bypass security checks and potentially gain unauthorized access or perform other malicious actions.
To fix this vulnerability, update the valib package to a version beyond 2.0.0.
There is no specific workaround mentioned for this vulnerability. Updating the valib package is the recommended solution.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 7.5.
