Remote Code Execution Vulnerability in Artifex MuJS JavaScript Engine
CVE-2022-44789

8.8HIGH

Key Information:

Vendor
Artifex
Status
Mujs
Vendor
CVE Published:
23 November 2022

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A logical issue in the O_getOwnPropertyDescriptor() function within the Artifex MuJS JavaScript engine allows attackers to execute arbitrary code remotely. This vulnerability arises due to memory corruption when handling specially crafted JavaScript files, potentially compromising the integrity of applications utilizing this engine. Users are advised to upgrade to version 1.3.2 or later to mitigate the risk associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-44789
Created by alalng

References

https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3...
https://github.com/alalng/CVE-2022-44789/blob/main/Public...
https://github.com/ccxvii/mujs/releases/tag/1.3.2

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.