CVE-2021-46553 : Security Advisory and Response

Cesanta MJS v2.20.0 SEGV Vulnerability

Understanding CVE-2021-46553

What is CVE-2021-46553?

Cesanta MJS v2.20.0 was found to have a SEGV vulnerability in mjs_set_internal at src/mjs_object.c, which could result in a Denial of Service (DoS) attack.

The Impact of CVE-2021-46553

This vulnerability could allow an attacker to trigger a denial of service condition on systems running the affected version of Cesanta MJS.

Technical Details of CVE-2021-46553

Vulnerability Description

The vulnerability exists in Cesanta MJS v2.20.0 due to improper handling of certain inputs, leading to a SEGV issue in mjs_set_internal at src/mjs_object.c.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Version: n/a

Exploitation Mechanism

The vulnerability can be exploited by an attacker sending specially crafted inputs to the vulnerable mjs_set_internal function, causing a crash and potentially leading to a DoS condition.

Mitigation and Prevention

Immediate Steps to Take

Disable or restrict access to the vulnerable component if possible.
Monitor network traffic for signs of exploitation.

Long-Term Security Practices

Regularly update software and apply patches from the vendor.
Conduct security assessments and audits to identify and address vulnerabilities.

Patching and Updates

Apply patches or updates provided by Cesanta to fix the vulnerability in MJS v2.20.0.