Miggo Logo

CVE-2018-3767: Denial of Service in memjs

9.1

CVSS Score
3.0

Basic Information

EPSS Score
0.60347%
Published
10/10/2018
Updated
9/12/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
memjsnpm<= 1.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsafe Buffer initialization in memjs's value handling. The advisory explicitly states the root cause is improper sanitization of the 'value' parameter passed to the Buffer constructor. In Node.js, new Buffer(value) with a numeric input creates a buffer of that size. The Client.prototype.set method is the primary entry point for storing values in memjs, making it the logical location where user-controlled values would be converted to buffers. This matches the CWE-400 (Uncontrolled Resource Consumption) pattern described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

V*rsions o* `m*mjs` prior to *.*.* *r* vuln*r**l* to **ni*l o* S*rvi** (*oS). T** p**k*** **ils to s*nitiz* t** `v*lu*` option p*ss** to t** *u***r *onstru*tor, w*i** m*y *llow *tt**k*rs to p*ss l*r** v*lu*s *x**ustin* syst*m r*sour**s. ## R**omm*

Reasoning

T** vuln*r**ility st*ms *rom uns*** *u***r initi*liz*tion in m*mjs's v*lu* **n*lin*. T** **visory *xpli*itly st*t*s t** root **us* is improp*r s*nitiz*tion o* t** 'v*lu*' p*r*m*t*r p*ss** to t** *u***r *onstru*tor. In No**.js, `n*w *u***r(v*lu*)` wit