7.5

CVE-2023-37899

Exploit

feathersjs socket handler allows abusing implicit toString

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`.  A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Feathersjs ≫ Feathers SwPlatformnode.js Version < 4.5.18
Feathersjs ≫ Feathers SwPlatformnode.js Version >= 5.0.0 < 5.0.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.96% 0.57
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19
Release Notes
https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19
Release Notes
https://github.com/feathersjs/feathers/pull/3241
Patch
https://github.com/feathersjs/feathers/pull/3242
Patch
https://github.com/feathersjs/feathers/security/advisories/GHSA-hhr9-rh25-hvf9
Vendor Advisory
Exploit