CVE-2022-42002

SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
References
Link Resource
https://github.com/lane711/sonicjs/tags Release Notes Third Party Advisory
https://snyk.io/blog/graphql-security-static-analysis-snyk-code/ Exploit Third Party Advisory
https://github.com/lane711/sonicjs/tags Release Notes Third Party Advisory
https://snyk.io/blog/graphql-security-static-analysis-snyk-code/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 07:24

Type Values Removed Values Added
References () https://github.com/lane711/sonicjs/tags - Release Notes, Third Party Advisory () https://github.com/lane711/sonicjs/tags - Release Notes, Third Party Advisory
References () https://snyk.io/blog/graphql-security-static-analysis-snyk-code/ - Exploit, Third Party Advisory () https://snyk.io/blog/graphql-security-static-analysis-snyk-code/ - Exploit, Third Party Advisory

Information

Published : 2022-10-01 00:15

Updated : 2024-11-21 07:24


NVD link : CVE-2022-42002

Mitre link : CVE-2022-42002

CVE.ORG link : CVE-2022-42002


JSON object : View

Products Affected

sonicjs

  • sonicjs
CWE
CWE-787

Out-of-bounds Write