critical9.8Public exploit code
CVE-2017-5941
An issue was discovered in the node-serialize package 0.0.4 for Node.js.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Node.JS - 'node-serialize' Remote Code Execution (3)2021-06-18 · webapps · nodejs
- Node.JS - 'node-serialize' Remote Code Execution (2)2021-02-10 · webapps · nodejs
- Node.JS - 'node-serialize' Remote Code Execution2017-02-08 · remote · linux
Impact
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node-Serialize Project | Node-Serialize | through 0.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161356/Node.JS-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163222/Node.JS-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96225
- https://nodesecurity.io/advisories/311
- https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
- http://packetstormsecurity.com/files/161356/Node.JS-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163222/Node.JS-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96225
- https://nodesecurity.io/advisories/311
- https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/