SB2024021316 - Multiple vulnerabilities in IBM QRadar Pulse App

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Prototype pollution (CVE-ID: CVE-2023-46308)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32006)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the module.constructor.createRequire() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32002)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the Module._load() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32559)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to usage of deprecated API process.binding(). A remote attacker can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7114777