{"id":"GHSA-hfrv-h3q8-9jpr","summary":"kurwov vulnerable to Denial of Service due to improper data sanitization","details":"### Summary\nAn unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly.\n\n### Details\nhttps://github.com/xiboon/kurwov/blob/0d58dfa42135ab40e830e92622857282f980ca89/src/MarkovData.ts#L38-L44\n\nIf a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the second line will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called).\n\n`data` is then defined as the special function found in its prototype instead of an array.\n\nOn the last line, `data` is then indexed by a random number, which is supposed to return a string but returns undefined as it's a function. Calling `endsWith` then throws.\n\n### PoC\nhttps://runkit.com/embed/m6uu40r5ja9b\n\n### Impact\nAny dataset can be contaminated with the substring making it unable to properly generate anything in some cases.","aliases":["CVE-2024-34075"],"modified":"2024-05-03T20:56:34.847539Z","published":"2024-05-03T20:30:38Z","database_specific":{"nvd_published_at":"2024-05-03T18:15:09Z","cwe_ids":["CWE-502"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-05-03T20:30:38Z"},"references":[{"type":"WEB","url":"https://github.com/xiboon/kurwov/security/advisories/GHSA-hfrv-h3q8-9jpr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34075"},{"type":"WEB","url":"https://github.com/xiboon/kurwov/commit/85d63e652594f121d6656177d7a3c0d823c976c9"},{"type":"PACKAGE","url":"https://github.com/xiboon/kurwov"},{"type":"WEB","url":"https://github.com/xiboon/kurwov/blob/0d58dfa42135ab40e830e92622857282f980ca89/src/MarkovData.ts#L38-L44"}],"affected":[{"package":{"name":"kurwov","ecosystem":"npm","purl":"pkg:npm/kurwov"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-hfrv-h3q8-9jpr/GHSA-hfrv-h3q8-9jpr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}