Remote Code Execution (RCE) Affecting blitz package, versions >=0.1.0 <0.45.3
Threat Intelligence
EPSS
0.46% (76th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-BLITZ-2397273
- published 10 Feb 2022
- disclosed 10 Feb 2022
- credit paul-gerste-sonarsource
Introduced: 10 Feb 2022
CVE-2022-23631 Open this link in a new tabHow to fix?
Upgrade blitz to version 0.45.3 or higher.
Overview
blitz is a Blitz is a Rails-like framework for monolithic, full-stack React apps — built on Next.js
Affected versions of this package are vulnerable to Remote Code Execution (RCE) as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems.
CVSS Scores
version 3.1