CVE-2021-39131: Ced Improper Handling Of Unexpected Data Vulnerability
HIGHCVE-2021-39131 is a HIGH (CVSS 7.5) improper handling of unexpected data vulnerability (CWE-241: Improper Handling of Unexpected Data Type) affecting Ced libraries in the npm ecosystem. The issue involves improper handling of unexpected data type in ced. Remediation is available by upgrading affected packages to version 1.0.0.
CVE-2021-39131 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2021-39131
To remediate this vulnerability, upgrade all affected Ced dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install ced@1.0.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls cedHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2021-39131, inspect your project dependencies using npm:
npm ls cedAnalyze the terminal output to locate any version of Ced in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.0), your application is affected.
Note: The npm ls ced command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-241: Improper Handling of Unexpected Data Type, where the product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (a-z). In Ced, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-39131 Affected Ced Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
ced
|
npm |
< 1.0.0
|
1.0.0
|
References
Frequently Asked Questions
What is CVE-2021-39131?
Which Ced versions are affected?
What version fixes CVE-2021-39131?
Is ced affected?
What is the CVSS score of CVE-2021-39131?
What CWE is associated with CVE-2021-39131?
How can I check npm dependencies for CVE-2021-39131?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-27wq-qx3q-fxm9",
"modified" : "2021-10-21T14:15:51Z",
"published" : "2021-08-23T19:42:28Z",
"aliases" : [ "CVE-2021-39131" ],
"summary" : "Improper Handling of Unexpected Data Type in ced",
"details" : "### Impact\n\nIn ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash.\n\n### Patches\n\nThe problem has been patched in [ced v1.0.0](https://github.com/sonicdoe/ced/releases/tag/v1.0.0). You can upgrade from v0.1.0 without any breaking changes.\n\n### Workarounds\n\nBefore passing an argument to ced, verify it’s a `Buffer` using [`Buffer.isBuffer(obj)`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_isbuffer_obj).\n\n### CVSS score\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)\n\nBase Score: 7.5 (High)\nTemporal Score: 7.2 (High)\n\nSince ced is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to ced. Depending on your specific implementation, the vulnerability’s severity in your program may be different.\n\n### Proof of concept\n\n```js\nconst express = require(\"express\");\nconst bodyParser = require(\"body-parser\");\nconst ced = require(\"ced\");\n\nconst app = express();\n\napp.use(bodyParser.raw());\n\napp.post(\"/\", (req, res) => {\n const encoding = ced(req.body);\n\n res.end(encoding);\n});\n\napp.listen(3000);\n```\n\n`curl --request POST --header \"Content-Type: text/plain\" --data foo http://localhost:3000` crashes the server.\n\n### References\n\n- https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "ced"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.0.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sonicdoe/ced/security/advisories/GHSA-27wq-qx3q-fxm9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-39131"
}, {
"type" : "WEB",
"url" : "https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sonicdoe/ced"
}, {
"type" : "WEB",
"url" : "https://github.com/sonicdoe/ced/releases/tag/v1.0.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-241" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2021-08-23T17:18:32Z",
"nvd_published_at" : "2021-08-17T23:15:00Z"
}
}