CVE-2015-8857 - The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript

Back Back to CVE browser

CRITICAL

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript

Published Jan 23, 2017

9.8

CRITICAL

CVSS 3.1

EPSS 3.56%

Description

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Affected products

Ecosystem	Package	Introduced	Fixed
RubyGems	uglifier	0	2.7.2
npm	uglify-js	0	2.4.24

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-1254

CWE-254

CWE-670

References (10)

http://www.openwall.com/lists/oss-security/2016/04/20/11
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/96410
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-34r7-q49f-h37c
Advisory
https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e
https://github.com/mishoo/UglifyJS2/issues/751
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml
https://nodesecurity.io/advisories/39
x_refsource_CONFIRMExploitPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8857
https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410
https://zyan.scripts.mit.edu/blog/backdooring-js/

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2016/04/20/11		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/96410		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-34r7-q49f-h37c		Advisory
https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e
https://github.com/mishoo/UglifyJS2/issues/751
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml
https://nodesecurity.io/advisories/39		x_refsource_CONFIRMExploitPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8857
https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410
https://zyan.scripts.mit.edu/blog/backdooring-js/