CVE-2021-45005
📋 TL;DR
CVE-2021-45005 is a heap buffer overflow vulnerability in Artifex MuJS v1.1.3 caused by conflicting JumpList handling in nested try/finally statements. This allows attackers to execute arbitrary code or cause denial of service. Anyone using MuJS v1.1.3 in applications is affected.
💻 Affected Systems
- Artifex MuJS
📦 What is this software?
Mujs by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially leading to data corruption.
If Mitigated
Controlled crash with minimal impact if proper memory protections and sandboxing are implemented.
🎯 Exploit Status
Proof of concept exists in bug reports. Exploitation requires crafting malicious JavaScript with specific try/finally patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit df8559e7bdbc6065276e786217eeee70f28fce66 and later versions
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=704749
Restart Required: Yes
Instructions:
1. Update MuJS to version after commit df8559e7. 2. Recompile any applications using MuJS. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allSanitize JavaScript input to reject scripts with deeply nested try/finally statements.
Memory Protection
linuxEnable ASLR and DEP to reduce exploit success probability.
sysctl -w kernel.randomize_va_space=2
🧯 If You Can't Patch
- Isolate MuJS instances in containers or sandboxes with minimal privileges.
- Implement network segmentation to limit access to vulnerable services.
🔍 How to Verify
Check if Vulnerable:
Check if MuJS version is exactly 1.1.3 or if application uses commit before df8559e7.Check Version:
mujs --version or check build/commit hash in sourceVerify Fix Applied:
Verify MuJS version is after commit df8559e7 and test with known proof-of-concept scripts.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual JavaScript parsing errors
Network Indicators:
- Unexpected JavaScript payloads with nested try/finally patterns
SIEM Query:
source="*mujs*" AND (event_type="crash" OR error="segmentation fault")