CVE-2024-21524: 
JavaScript vulnerability analysis and mitigation

CVE-2024-21524 affects all versions of the node-stringbuilder package, which was discovered in July 2024. The vulnerability is classified as an Out-of-bounds Read vulnerability due to incorrect memory length calculation when calling specific methods on a StringBuilder object with a non-empty string value input (Snyk Advisory, NVD).

The vulnerability occurs when calling ToBuffer, ToString, or CharAt methods on a StringBuilder object with a non-empty string value input. The issue stems from incorrect memory length calculation, which allows access to previously allocated memory through negative indexes. The vulnerability has received a CVSS v3.1 base score of 9.1 (Critical) from NVD and 8.2 (High) from Snyk, indicating its severe nature (NVD, GitHub POC).

The vulnerability can lead to Information Disclosure by allowing attackers to access previously allocated memory. This could potentially expose sensitive information that was previously stored in memory. The vulnerability requires no authentication and can be exploited remotely (Snyk Advisory).

A proof-of-concept exploit has been published demonstrating the vulnerability. The exploit involves calling the affected methods with negative indexes, which can result in accessing out-of-bounds memory locations. The vulnerability can be triggered through the ToBuffer, ToString, or CharAt methods (GitHub POC).