8.8

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jvff-x2qm-6286

GHSA-jvff-x2qm-6286: mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impact

Two security vulnerabilities, the first of which was introduced in version 13.1.0, were detected that allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The problem is patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jvff-x2qm-6286

GHSA-jvff-x2qm-6286:

8.8

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mathjs	npm	>= 13.1.0, < 15.2.0	15.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the patch 0aee2f61866e35ffa0aef915221cdf6b026ffdd4 reveals two primary vulnerabilities that allow arbitrary JavaScript execution through the mathjs expression parser.

First, the get function in src/utils/array.js, which is used by matrix types like DenseMatrix and SparseMatrix, failed to validate that its index argument was an array. The patch rectifies this by adding an Array.isArray(index) check. Before the fix, an attacker could provide a specially crafted object as the index. When the function attempted to iterate over this object, it could trigger malicious methods (like reduce in the exploit PoC), leading to code execution. The vulnerable functions in a runtime profile would be DenseMatrix.get or SparseMatrix.get calling the underlying vulnerable get.

Second, the property access control functions in src/utils/customs.js were too permissive for arrays. The original isSafeProperty function allowed any property to be set on an array. This was exploited by overwriting the map property of an array instance within the expression. When this array was later used, the attacker-controlled map function would be executed. The patch replaces isSafeProperty with more granular checks, isSafeObjectProperty and isSafeArrayProperty, where the latter only permits numeric indices and the length property to be accessed or modified on arrays. The vulnerable functions in this scenario are setSafeProperty and getSafeProperty, which are called internally by the expression parser during assignment and member access operations.

Vulnerable functions

get

src/utils/array.js

The `get` function did not validate that the `index` parameter was an array. This allowed an attacker to pass a crafted object instead of an array, which could lead to arbitrary code execution when properties of the malicious object (like `reduce`) were accessed. This function is called by matrix `get` methods.

setSafeProperty

src/utils/customs.js

The `setSafeProperty` function, prior to the patch, used a weak validation (`isSafeProperty`) that allowed setting arbitrary properties on JavaScript arrays. An attacker could overwrite properties like `map` on an array instance, leading to arbitrary code execution when the modified array was used in subsequent operations within the expression parser.

getSafeProperty

src/utils/customs.js

Similar to `setSafeProperty`, the `getSafeProperty` function used a weak validation that allowed accessing properties of arrays that should have been restricted. This could be abused to leak sensitive information or obtain references to built-in functions that could be used in an exploit chain.

DenseMatrix.get

src/type/matrix/DenseMatrix.js

The `DenseMatrix.get` method is a public API that directly calls the vulnerable `array.get` function. It serves as an entry point for the vulnerability where a crafted object could be passed as an index, leading to code execution. The evidence is from the added test case which explicitly tests this exploit vector.

SparseMatrix.get

src/type/matrix/SparseMatrix.js

The `SparseMatrix.get` method is a public API that directly calls the vulnerable `array.get` function. It serves as an entry point for the vulnerability where a crafted object could be passed as an index, leading to code execution. The evidence is from the added test case which explicitly tests this exploit vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.