Cloudanix VulnDB

CVE-2021-46349

Medium · 5.5

CVSS

5.5

EPSS

0.6%

Published

Jan 20, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in a JavaScript engine can make any program that uses it stop working when it receives certain inputs.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Assertion failure in ecma-objects.c when processing certain JavaScript object types, causing immediate process termination via abort.

Why it matters to the business

Applications embedding the JerryScript engine can be forced to crash on demand, interrupting services and requiring restarts with no data corruption but clear availability loss.

How an attack unfolds

An attacker supplies a crafted JavaScript payload containing an object that violates internal type assumptions; when JerryScript evaluates it the assertion in ecma-objects.c fires and the process aborts.

How to fix it

Upgrade JerryScript to the first release containing the fix for this assertion (post-3.0.0); rebuild and redeploy all dependent applications; validate with the original reproducer.

How to confirm the fix worked

Run the engine against the known crashing test case and confirm it no longer aborts; inspect binary or source for removal of the failing assertion line; verify version string is newer than 3.0.0.

Typical attack path

  1. Locate an application or service that embeds vulnerable JerryScript
  2. Craft or obtain a JavaScript snippet triggering the type assertion
  3. Cause the engine to parse or execute the input (file load, eval, or network-supplied script)
  4. Trigger the assertion failure resulting in immediate crash

How to detect it

Search application and system logs, core dumps, and stderr for the exact assertion failure message and source file path; correlate with process crashes of jerry or embedding binaries shortly after JavaScript execution.

  • type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY
  • /jerry-core/ecma/operations/ecma-objects.c
  • Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed

What your security team should do

  • Prioritize upgrade of all JerryScript instances within the next sprint
  • Add the assertion string to SIEM rules for crash detection
  • Review any locally maintained JerryScript forks for the same code path
  • Disable untrusted script execution until patched

The record

There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS iotjs 0 No fix
Ubuntu:22.04:LTS iotjs 0 No fix
Ubuntu:Pro:18.04:LTS iotjs 0 No fix
conan jerryscript 3.0.0 No fix

Related vulnerabilities