CVE-2024-21537 - Vulnerability Details - OpenCVE

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Antonk52	Lilconfig

No data.

No data.

References

Link	Providers
https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7
https://github.com/antonk52/lilconfig/pull/48
https://github.com/antonk52/lilconfig/releases/tag/v3.1.1
https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789

History

Thu, 31 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Antonk52 Antonk52 lilconfig
CPEs		cpe:2.3:a:antonk52:lilconfig::::::::
Vendors & Products		Antonk52 Antonk52 lilconfig
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 31 Oct 2024 05:15:00 +0000

Type	Values Removed	Values Added
Description		Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.
Weaknesses		CWE-94
References		https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7 https://github.com/antonk52/lilconfig/pull/48 https://github.com/antonk52/lilconfig/releases/tag/v3.1.1 https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P'}`

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2024-10-31T05:00:03.948Z

Updated: 2024-10-31T13:39:14.418Z

Reserved: 2023-12-22T12:33:20.123Z

Link: CVE-2024-21537

Vulnrichment

Updated: 2024-10-31T13:39:09.242Z

NVD

Status : Awaiting Analysis

Published: 2024-10-31T05:15:04.733

Modified: 2024-11-01T12:57:03.417

Link: CVE-2024-21537

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21537", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "state": "PUBLISHED", "assignerShortName": "snyk", "dateReserved": "2023-12-22T12:33:20.123Z", "datePublished": "2024-10-31T05:00:03.948Z", "dateUpdated": "2024-10-31T13:39:14.418Z"}, "containers": {"cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P"}}], "credits": [{"value": "Anton Kastritskiy", "lang": "en"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Arbitrary Code Execution", "lang": "en"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2024-10-31T05:00:03.948Z"}, "descriptions": [{"value": "Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.", "lang": "en"}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789"}, {"url": "https://github.com/antonk52/lilconfig/pull/48"}, {"url": "https://github.com/antonk52/lilconfig/releases/tag/v3.1.1"}, {"url": "https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7"}], "affected": [{"product": "lilconfig", "versions": [{"version": "3.1.0", "lessThan": "3.1.1", "status": "affected", "versionType": "semver"}], "vendor": "n/a"}]}, "adp": [{"affected": [{"vendor": "antonk52", "product": "lilconfig", "cpes": ["cpe:2.3:a:antonk52:lilconfig:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.1.0", "status": "affected", "lessThan": "3.1.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-31T13:36:33.334174Z", "id": "CVE-2024-21537", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T13:39:14.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21537", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-31T13:36:33.334174Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:antonk52:lilconfig:*:*:*:*:*:*:*:*"], "vendor": "antonk52", "product": "lilconfig", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.1", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T13:39:09.242Z"}}], "cna": {"credits": [{"lang": "en", "value": "Anton Kastritskiy"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n/a", "product": "lilconfig", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.1", "versionType": "semver"}]}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789"}, {"url": "https://github.com/antonk52/lilconfig/pull/48"}, {"url": "https://github.com/antonk52/lilconfig/releases/tag/v3.1.1"}, {"url": "https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7"}], "descriptions": [{"lang": "en", "value": "Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "Arbitrary Code Execution"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2024-10-31T05:00:03.948Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21537", "state": "PUBLISHED", "dateUpdated": "2024-10-31T13:39:14.418Z", "dateReserved": "2023-12-22T12:33:20.123Z", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "datePublished": "2024-10-31T05:00:03.948Z", "assignerShortName": "snyk"}, "dataVersion": "5.1"}