CRITICAL🇵🇱 Wersja polska

CVE-2024-24292

CVSS 9.8v3.1pub. 2025-03-28upd. 2025-04-17

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component.

🤖 AI Analysis
How it works

The vulnerability (CWE-1321) consists of the ability to modify the prototype of built-in JavaScript objects through unclean input data. An attacker can provide a crafted object containing properties such as '__proto__', which will be merged with the global Object prototype. In the case of Aliconnect SDK, the vulnerable component is aim.js — specifically the aim() function — which processes input data without proper validation, leading to prototype poisoning and arbitrary code execution.

Impact

An attacker can execute arbitrary code on the server side (RCE), which can effectively lead to complete breach of confidentiality, integrity and availability of the system — including takeover of the application and its operating environment.

Mitigation & patch

Patches available from the vendor should be applied according to references. Until a fix is released, it is recommended to avoid using the aim() function with untrusted input data, implement input validation and sanitization, and consider applying Object.freeze(Object.prototype) as a temporary workaround.

Who is affected

Aliconnect Software Development Kit (package /sdk) in version 0.0.6

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Aliconnect Software Development Kit

    APP
    Aliconnect
    0.0.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References