CVE-2021-23329
📋 TL;DR
This vulnerability in the nested-object-assign npm package allows attackers to modify JavaScript object prototypes through prototype pollution. This can lead to denial of service, remote code execution, or privilege escalation in applications using this library. Any Node.js application using vulnerable versions of this package is affected.
💻 Affected Systems
- nested-object-assign npm package
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Denial of service, application crashes, or unauthorized modification of application behavior through prototype pollution.
If Mitigated
Limited impact if input validation and sanitization are properly implemented, though prototype pollution risks remain.
🎯 Exploit Status
Proof of concept code is publicly available and exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4
Vendor Advisory: https://github.com/Geta/NestedObjectAssign/pull/11
Restart Required: Yes
Instructions:
1. Update package.json to require nested-object-assign version 1.0.4 or higher. 2. Run 'npm update nested-object-assign' or 'yarn upgrade nested-object-assign'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation and sanitization for all user-controlled objects before passing to nested-object-assign functions.
🧯 If You Can't Patch
- Remove or replace nested-object-assign with alternative object merging libraries
- Implement strict Content Security Policy and input validation controls
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for nested-object-assign version. If version is below 1.0.4, you are vulnerable.Check Version:
npm list nested-object-assignVerify Fix Applied:
Verify nested-object-assign version is 1.0.4 or higher in package.json and node_modules/nested-object-assign/package.json.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Prototype pollution attempts in logs
Network Indicators:
- HTTP requests with specially crafted JSON payloads targeting object merging endpoints
SIEM Query:
source="application_logs" AND ("prototype pollution" OR "nested-object-assign" OR "CVE-2021-23329")