Vulnerability-Lookup

CVE-2024-43357 (GCVE-0-2024-43357)

Vulnerability from cvelistv5 – Published: 2024-08-15 18:36 – Updated: 2024-08-15 19:10

Title

JavaScript specification issue may lead to type confusion and pointer dereference in implementations

Summary

ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants. The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section. ## References - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https://www.cve.org/CVERecord?id=CVE-2024-7652

Severity ?

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE

CWE-248 - Uncaught Exception
CWE-476 - NULL Pointer Dereference
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/tc39/ecma262/security/advisori…	x_refsource_CONFIRM
	https://github.com/boa-dev/boa/security/advisorie…	x_refsource_MISC
	https://github.com/tc39/ecma262/pull/2413	x_refsource_MISC
	https://github.com/tc39/ecma262/commit/1e24a286d0…	x_refsource_MISC
	https://github.com/tc39/ecma262/commit/4cb5a6980e…	x_refsource_MISC
	https://bugs.webkit.org/show_bug.cgi?id=275407	x_refsource_MISC
	https://bugzilla.mozilla.org/show_bug.cgi?id=1901411	x_refsource_MISC
	https://issues.chromium.org/issues/346692561	x_refsource_MISC
	https://tc39.es/ecma262/#sec-asyncgenerator-objects	x_refsource_MISC
	https://www.cve.org/CVERecord?id=CVE-2024-7652	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	tc39	ecma262	Affected: >= 2022, < 2025

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ecma_international:ecma262:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ecma262",
            "vendor": "ecma_international",
            "versions": [
              {
                "lessThan": "2025",
                "status": "affected",
                "version": "2022",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43357",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-15T18:59:18.834850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T19:10:00.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ecma262",
          "vendor": "tc39",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2022, \u003c 2025"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference.\n\nThe internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants.\n\nThe ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory\u0027s public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section.\n\n## References\n\n- https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727\n- https://bugzilla.mozilla.org/show_bug.cgi?id=1901411\n- https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq\n- https://bugs.webkit.org/show_bug.cgi?id=275407\n- https://issues.chromium.org/issues/346692561\n- https://www.cve.org/CVERecord?id=CVE-2024-7652"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-15T18:36:49.012Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
        },
        {
          "name": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq"
        },
        {
          "name": "https://github.com/tc39/ecma262/pull/2413",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tc39/ecma262/pull/2413"
        },
        {
          "name": "https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727"
        },
        {
          "name": "https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3"
        },
        {
          "name": "https://bugs.webkit.org/show_bug.cgi?id=275407",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.webkit.org/show_bug.cgi?id=275407"
        },
        {
          "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411"
        },
        {
          "name": "https://issues.chromium.org/issues/346692561",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://issues.chromium.org/issues/346692561"
        },
        {
          "name": "https://tc39.es/ecma262/#sec-asyncgenerator-objects",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tc39.es/ecma262/#sec-asyncgenerator-objects"
        },
        {
          "name": "https://www.cve.org/CVERecord?id=CVE-2024-7652",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7652"
        }
      ],
      "source": {
        "advisory": "GHSA-g38c-wh3c-5h9r",
        "discovery": "UNKNOWN"
      },
      "title": "JavaScript specification issue may lead to type confusion and pointer dereference in implementations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43357",
    "datePublished": "2024-08-15T18:36:49.012Z",
    "dateReserved": "2024-08-09T14:23:55.511Z",
    "dateUpdated": "2024-08-15T19:10:00.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43357\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-15T18:59:18.834850Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ecma_international:ecma262:*:*:*:*:*:*:*:*\"], \"vendor\": \"ecma_international\", \"product\": \"ecma262\", \"versions\": [{\"status\": \"affected\", \"version\": \"2022\", \"lessThan\": \"2025\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-15T19:09:51.871Z\"}}], \"cna\": {\"title\": \"JavaScript specification issue may lead to type confusion and pointer dereference in implementations\", \"source\": {\"advisory\": \"GHSA-g38c-wh3c-5h9r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"tc39\", \"product\": \"ecma262\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2022, \u003c 2025\"}]}], \"references\": [{\"url\": \"https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r\", \"name\": \"https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq\", \"name\": \"https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tc39/ecma262/pull/2413\", \"name\": \"https://github.com/tc39/ecma262/pull/2413\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727\", \"name\": \"https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3\", \"name\": \"https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://bugs.webkit.org/show_bug.cgi?id=275407\", \"name\": \"https://bugs.webkit.org/show_bug.cgi?id=275407\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1901411\", \"name\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1901411\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://issues.chromium.org/issues/346692561\", \"name\": \"https://issues.chromium.org/issues/346692561\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://tc39.es/ecma262/#sec-asyncgenerator-objects\", \"name\": \"https://tc39.es/ecma262/#sec-asyncgenerator-objects\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-7652\", \"name\": \"https://www.cve.org/CVERecord?id=CVE-2024-7652\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference.\\n\\nThe internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants.\\n\\nThe ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory\u0027s public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section.\\n\\n## References\\n\\n- https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727\\n- https://bugzilla.mozilla.org/show_bug.cgi?id=1901411\\n- https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq\\n- https://bugs.webkit.org/show_bug.cgi?id=275407\\n- https://issues.chromium.org/issues/346692561\\n- https://www.cve.org/CVERecord?id=CVE-2024-7652\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-843\", \"description\": \"CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-08-15T18:36:49.012Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43357\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-15T19:10:00.235Z\", \"dateReserved\": \"2024-08-09T14:23:55.511Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-08-15T18:36:49.012Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

cve-2024-43357

Vulnerability from osv_rustsec

Published

2024-08-14 12:00

Modified

2025-12-19 06:15

Summary

Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`

Details

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts.

Details

Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by methods of AsyncGenerator such as %AsyncGeneratorPrototype%.next, %AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.

However, a carefully constructed code could trigger a state transition from a getter method for the promise's then property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.

Patches

Version 0.19.0 is patched to correctly handle this case.

Workarounds

Users unable to upgrade to the patched version would want to use std::panic::catch_unwind to ensure any exceptions caused by the engine don't impact the availability of the main application.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "boa_engine",
        "purl": "pkg:cargo/boa_engine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.19.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-f67q-wr6w-23jq",
    "CVE-2024-43367"
  ],
  "database_specific": {
    "license": "CC-BY-4.0"
  },
  "details": "A wrong assumption made when handling ECMAScript\u0027s AsyncGenerator operations\ncan cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa\u0027s implementation of AsyncGenerator makes the assumption that the state of\nan AsyncGenerator object cannot change while resolving a promise created by\nmethods of AsyncGenerator such as %AsyncGeneratorPrototype%.next,\n%AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.\n\nHowever, a carefully constructed code could trigger a state transition from\na getter method for the promise\u0027s then property, which causes the engine to\nfail an assertion of this assumption, causing an uncaught exception. This\ncould be used to create a Denial Of Service attack in applications that\nrun arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use\nstd::panic::catch_unwind to ensure any exceptions caused by the\nengine don\u0027t impact the availability of the main application.",
  "id": "RUSTSEC-2024-0444",
  "modified": "2025-12-19T06:15:15Z",
  "published": "2024-08-14T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/boa_engine"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0444.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43357"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7"
    }
  ],
  "related": [
    "CVE-2024-43357"
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`"
}

FKIE_CVE-2024-43357

Vulnerability from fkie_nvd - Published: 2024-08-15 19:15 - Updated: 2024-08-19 13:00

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://bugs.webkit.org/show_bug.cgi?id=275407
	security-advisories@github.com	https://bugzilla.mozilla.org/show_bug.cgi?id=1901411
	security-advisories@github.com	https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq
	security-advisories@github.com	https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727
	security-advisories@github.com	https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3
	security-advisories@github.com	https://github.com/tc39/ecma262/pull/2413
	security-advisories@github.com	https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r
	security-advisories@github.com	https://issues.chromium.org/issues/346692561
	security-advisories@github.com	https://tc39.es/ecma262/#sec-asyncgenerator-objects
	security-advisories@github.com	https://www.cve.org/CVERecord?id=CVE-2024-7652

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference.\n\nThe internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants.\n\nThe ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory\u0027s public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section.\n\n## References\n\n- https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727\n- https://bugzilla.mozilla.org/show_bug.cgi?id=1901411\n- https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq\n- https://bugs.webkit.org/show_bug.cgi?id=275407\n- https://issues.chromium.org/issues/346692561\n- https://www.cve.org/CVERecord?id=CVE-2024-7652"
    },
    {
      "lang": "es",
      "value": "ECMA-262 es la especificaci\u00f3n del lenguaje para el lenguaje de scripting ECMAScript. Un problema en la especificaci\u00f3n ECMAScript (JavaScript) de los generadores as\u00edncronos, introducido por una refactorizaci\u00f3n de especificaciones de mayo de 2021, puede provocar una implementaci\u00f3n incorrecta de una manera que podr\u00eda presentarse como una vulnerabilidad de seguridad, como confusi\u00f3n de tipos y desreferencia de puntero. La maquinaria interna del generador as\u00edncrono llama a funciones regulares de resoluci\u00f3n de promesas en los objetos IteratorResult (`{ done, value }`) que crea, asumiendo que los objetos IteratorResult no ser\u00e1n habilitables en ese momento. Desafortunadamente, estos objetos IteratorResult heredan de `Object.prototype`, por lo que estos objetos IteratorResult pueden volverse compatibles, lo que desencadena un comportamiento arbitrario, incluido el reingreso a la maquinaria del generador as\u00edncrono de una manera que viola algunas invariantes internas. La especificaci\u00f3n ECMAScript es un est\u00e1ndar de vida y el problema se ha abordado en el momento de la divulgaci\u00f3n p\u00fablica de este aviso. Los implementadores del motor JavaScript deben consultar la especificaci\u00f3n m\u00e1s reciente y actualizar sus implementaciones para cumplir con la secci\u00f3n \"AsyncGenerator\". ## Referencias: https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/ boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https:// www.cve.org/CVERecord?id=CVE-2024-7652"
    }
  ],
  "id": "CVE-2024-43357",
  "lastModified": "2024-08-19T13:00:23.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-08-15T19:15:20.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://bugs.webkit.org/show_bug.cgi?id=275407"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1901411"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tc39/ecma262/pull/2413"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://issues.chromium.org/issues/346692561"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://tc39.es/ecma262/#sec-asyncgenerator-objects"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7652"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-476"
        },
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-43357 (GCVE-0-2024-43357)

cve-2024-43357

Vulnerability from osv_rustsec

Details

Patches

Workarounds

FKIE_CVE-2024-43357

Tags

Sightings

Nomenclature