CVE-2021-23337

Q: What is the severity of CVE-2021-23337?

CVE-2021-23337 has a CVSS score of 7.2 (HIGH). Lodash versions before 4.17.21 contain a command injection vulnerability in the template function that allows attackers to execute arbitrary commands on the host system. This affects any application using vulnerable Lodash versions, particularly web applications that process user input through template functions. The vulnerability stems from improper input validation in the template engine.

7.2 HIGH

Remote Code Execution

📋 TL;DR

Lodash versions before 4.17.21 contain a command injection vulnerability in the template function that allows attackers to execute arbitrary commands on the host system. This affects any application using vulnerable Lodash versions, particularly web applications that process user input through template functions. The vulnerability stems from improper input validation in the template engine.

💻 Affected Systems

Products:

Lodash
Applications using Lodash library
Java applications using org.webjars.npm:lodash or org.fujion.webjars:lodash

Versions: All versions before 4.17.21

Operating Systems: All operating systems where Lodash runs (Linux, Windows, macOS, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Only applications using the vulnerable template() function with untrusted input are exploitable. Many applications use Lodash but may not use this specific function.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full remote code execution leading to complete system compromise, data exfiltration, ransomware deployment, or lateral movement within the network.

🟠

Likely Case

Limited command execution within the application's context, potentially allowing file system access, data manipulation, or further privilege escalation.

🟢

If Mitigated

No impact if input validation prevents malicious template content or if the vulnerable function isn't used with untrusted input.

🌐 Internet-Facing: HIGH - Web applications processing user input through Lodash templates are directly exposed to exploitation attempts.

🏢 Internal Only: MEDIUM - Internal applications using Lodash templates with user input remain vulnerable, though attack surface is reduced.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the application to use Lodash's template() function with user-controlled input. Public proof-of-concept code demonstrates command injection.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.17.21 and later

Vendor Advisory: https://github.com/lodash/lodash/releases/tag/4.17.21

Restart Required: No

Instructions:

1. Update Lodash dependency to version 4.17.21 or higher. 2. For npm: 'npm update lodash'. 3. For yarn: 'yarn upgrade lodash'. 4. Update package.json to specify 'lodash': '^4.17.21'. 5. Rebuild and redeploy application.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Implement strict input validation and sanitization for any data passed to Lodash template() function

Disable Template Function

all

Remove or disable usage of Lodash template() function if not required

🧯 If You Can't Patch

Implement strict input validation to prevent malicious template content
Use application firewalls (WAF) to block command injection patterns

🔍 How to Verify

Check if Vulnerable:

Check package.json or package-lock.json for lodash version below 4.17.21. Run 'npm list lodash' or 'yarn list lodash' to check installed version.

Check Version:

npm list lodash | grep lodash OR node -e "console.log(require('lodash').VERSION)"

Verify Fix Applied:

Confirm lodash version is 4.17.21 or higher using 'npm list lodash' or checking package.json. Test template functionality with safe inputs.

📡 Detection & Monitoring

Log Indicators:

Unusual command execution patterns
Template processing errors with suspicious content
System command execution from application context

Network Indicators:

Outbound connections from application to unexpected destinations
Command and control traffic patterns

SIEM Query:

source="application_logs" AND ("template injection" OR "command execution" OR "lodash template")

📊 Metadata

CVE ID: CVE-2021-23337

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: February 15, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Patch,Third Party Advisory
https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 Broken Link
https://security.netapp.com/advisory/ntap-20210312-0006/ Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-1040724 Exploit,Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Patch,Third Party Advisory
https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 Broken Link
https://security.netapp.com/advisory/ntap-20210312-0006/ Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-1040724 Exploit,Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Trade Finance Process Management by Oracle

Banking Trade Finance Process Management by Oracle

Banking Trade Finance Process Management by Oracle

Cloud Manager by Netapp

Communications Cloud Native Core Binding Support Function by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Design Studio by Oracle

Communications Services Gatekeeper by Oracle

Communications Session Border Controller by Oracle

Communications Session Border Controller by Oracle

Enterprise Communications Broker by Oracle

Enterprise Communications Broker by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Financial Services Crime And Compliance Management Studio by Oracle

Health Sciences Data Management Workbench by Oracle

Health Sciences Data Management Workbench by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Lodash by Lodash

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Sinec Ins by Siemens

Sinec Ins by Siemens

Sinec Ins by Siemens

System Manager by Netapp

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input Validation and Sanitization

Disable Template Function

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities