Skip to content

Update index.js - #19

Open
MorielHarush wants to merge 1 commit into
inikulin:masterfrom
MorielHarush:master
Open

MorielHarush wants to merge 1 commit into
inikulin:masterfrom
MorielHarush:master

Conversation

@MorielHarush

Copy link
Copy Markdown

Hey , This pull request is to fix a security vulnerability which allows Remote Code Execution
CWE-502: Deserialization of Untrusted Data
PoC to test the vulnerability :

const Replicator = require('replicator');
const replicator = new Replicator();

replicator.decode('[{"@t":"[[Error]]","data":{"name":"Function","message":"require(\'child_process\').exec(\'open -a Calculator\')"}}]')();

image

@MorielHarush

Copy link
Copy Markdown
Author

@inikulin Any concerns ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant