CVE-2023-45311: Code Injection in fsevents
Summary
CVE-2023-45311: Code injection in fsevents. Affects fsevents versions < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fsevents is an npm package that provides a Node.js API for listening to file system events. It is commonly used in JavaScript projects to monitor changes in directories and files. However, versions of fsevents prior to 1.2.11 have a vulnerability that allows code injection. This vulnerability arises from the package's dependency on the 'https://fsevents-binaries.s3-us-west-2.amazonaws.com' URL. If a JavaScript project, which relies on fsevents, includes code obtained from this URL when it was controlled by an adversary, it could lead to the execution of arbitrary code.
Vulnerability Detail
The vulnerability in fsevents allows an adversary to execute arbitrary code by distributing malicious code through the 'https://fsevents-binaries.s3-us-west-2.amazonaws.com' URL. This can occur if a JavaScript project includes code obtained from this URL during a period when it was controlled by an adversary. The impact of this vulnerability can be severe, as it enables unauthorized code execution, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
1.2.11
This is the first release that contains the fix.
npm install fsevents@1.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the fsevents package to the fixed version as soon as possible.
Conclusion
The vulnerability in fsevents allows for code injection and arbitrary code execution. To mitigate this risk, it is crucial to update the fsevents package to version 1.2.11 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fsevents →
FAQ
fsevents is an npm package that provides a Node.js API for listening to file system events. It is commonly used in JavaScript projects to monitor changes in directories and files.
The vulnerability arises from fsevents' dependency on the 'https://fsevents-binaries.s3-us-west-2.amazonaws.com' URL. If a JavaScript project includes code obtained from this URL during a period when it was controlled by an adversary, it can lead to code injection and arbitrary code execution.
The vulnerability allows an adversary to execute arbitrary code, which can result in unauthorized access, data breaches, or system compromise.
To fix this vulnerability, update the fsevents package to version 1.2.11 or later by running 'npm install fsevents@latest' in the project's root directory.
There is no known workaround for this vulnerability. Updating the fsevents package to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for fsevents.
