=====================================================================

                               CERT-Renater

                     Note d'Information No. 2023/VULN406

_____________________________________________________________________

DATE                : 16/10/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running babel/traverse (npm)  versions
                       prior to 7.23.2, 8.0.0-alpha.4.

=====================================================================
https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
_____________________________________________________________________


Arbitrary code execution when compiling specifically crafted
malicious code

Critical
nicolo-ribaudo published GHSA-67hx-6x53-jw92

Package
@babel/traverse (npm)

Affected versions
<= 7.23.0
8.0.0-alpha.0 - 8.0.0-alpha.3

Patched versions
< 7.23.2
>= 8.0.0-alpha.0, < 8.0.0-alpha.4



Description

Impact

Using Babel to compile code that was specifically crafted by an
attacker can lead to arbitrary code execution during compilation,
when using plugins that rely on the path.evaluate()or
path.evaluateTruthy() internal Babel methods.

Known affected plugins are:

     @babel/plugin-transform-runtime
     @babel/preset-env when using its useBuiltIns option
     Any "polyfill provider" plugin that depends on 
@babel/helper-define-polyfill-provider, such as 
babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, 
babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator


No other plugins under the @babel/ namespace are impacted, but
third-party plugins might be.

Users that only compile trusted code are not impacted.


Patches

The vulnerability has been fixed in @babel/traverse@7.23.2.

Babel 6 does not receive security fixes anymore (see Babel's security
policy), hence there is no patch planned for babel-traverse@6.


Workarounds

     Upgrade @babel/traverse to v7.23.2 or higher. You can do this by
deleting it from your package manager's lockfile and re-installing
the dependencies. @babel/core >=7.23.2 will automatically pull in
a non-vulnerable version.
     If you cannot upgrade @babel/traverse and are using one of the
affected packages mentioned above, upgrade them to their latest
version to avoid triggering the vulnerable code path in affected
@babel/traverse versions:

         @babel/plugin-transform-runtime v7.23.2
         @babel/preset-env v7.23.2
         @babel/helper-define-polyfill-provider v0.4.3
         babel-plugin-polyfill-corejs2 v0.4.6
         babel-plugin-polyfill-corejs3 v0.8.5
         babel-plugin-polyfill-es-shims v0.10.0
         babel-plugin-polyfill-regenerator v0.5.3


Credits

Thanks William Khem-Marquez for reporting the vulnerability.


Severity
Critical

9.3/ 10

CVSS base metrics

Attack vector
Local

Attack complexity
Low

Privileges required
None

User interaction
None

Scope
Changed

Confidentiality
High

Integrity
High

Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE ID
CVE-2023-45133

Weaknesses
CWE-184


Credits

     @SteakEnthusiast SteakEnthusiast Reporter



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================