CVE-2023-52081

2023-12-2816:16:02

CWE-74

CWE-176

[email protected]

web.nvd.nist.gov

ffcss

cli interface

vulnerability

character validation

bypass

low impact

cve-2023-52081

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.1 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess() is meant to apply some transformations to a string by disabling characters in the regex [-_ .]. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex [-_ .]. The lookupPreprocess() can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. The lookupPreprocess() function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.

Affected configurations

Vulners

NVD

Node

ewen-lbhfirefox_cssRange<0.2.0

VendorProductVersionCPE
ewen\-lbhfirefox_css*cpe:2.3:a:ewen\-lbh:firefox_css:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ewen\-lbh	firefox_css	*	cpe:2.3:a:ewen\-lbh:firefox_css::::::::

CNA Affected

[
  {
    "vendor": "ewen-lbh",
    "product": "ffcss",
    "versions": [
      {
        "version": "< 0.2.0",
        "status": "affected"
      }
    ]
  }
]