CVE-2023-2583: Code Injection Vulnerability in jsreport
Summary
CVE-2023-2583: jsreport vulnerable to code injection. Affects jsreport versions < 3.11.3. Fixed in 3.11.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsreport is an npm package used for generating reports in various formats. It provides a playground server and a client for creating and rendering reports. The vulnerability in jsreport (prior to version 3.11.3) is related to a hardcoded version of vm2 (CVE-2023-29017) in the package.json of the jsreport-core component. This vulnerability allows an attacker to perform code injection attacks, potentially gaining unauthorized access to the jsreport playground server or executing malicious code on the client-side.
Vulnerability Detail
The code injection vulnerability in jsreport allows an attacker to exploit the vulnerable version of vm2 (CVE-2023-29017) to execute arbitrary code. This can lead to unauthorized access to the jsreport playground server or the ability to construct malicious webpages or HTML files that, when opened by a user, can execute code on the installed jsreport client. The impact of this vulnerability can be severe, as it allows an attacker to gain control over the affected system and potentially perform further malicious activities.
How To Fix
Minimum fixed version
3.11.3
This is the first release that contains the fix.
npm install jsreport@3.11.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update jsreport to the fixed version as soon as possible to protect against potential attacks.
Conclusion
The code injection vulnerability in jsreport (CVE-2023-2583) poses a significant risk to systems using vulnerable versions of jsreport. It is crucial to update to version 3.11.3 or later to mitigate the risk of unauthorized access and code execution. For further support and information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsreport →
FAQ
jsreport is an npm package used for generating reports in various formats. It provides a playground server and a client for creating and rendering reports.
The vulnerability allows an attacker to execute arbitrary code, potentially gaining unauthorized access to the jsreport playground server or executing malicious code on the client-side.
To fix this vulnerability, update jsreport to version 3.11.3 or later, which includes a fixed version of vm2.
No, there is no known workaround. It is crucial to update jsreport to the fixed version.
For more information and support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for jsreport.
