CVE-2021-23389
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of total.js framework. Attackers can exploit the U.set() and U.get() utility functions to inject and execute malicious code. Any application using total.js versions before 3.4.9 is affected.
💻 Affected Systems
- total.js framework
📦 What is this software?
Total.js by Totaljs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or deployment of ransomware.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though the vulnerability still exists.
🎯 Exploit Status
Exploitation is straightforward as the vulnerable functions are commonly used and the attack vector is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.9 and later
Vendor Advisory: https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
Restart Required: Yes
Instructions:
1. Update total.js package to version 3.4.9 or later using npm update totaljs. 2. Restart the application. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Wrapper
allWrap U.set() and U.get() calls with strict input validation to prevent code injection
// Implement input validation before calling U.set() or U.get()
// Example: if (typeof input !== 'string' || input.includes('__proto__')) throw new Error('Invalid input');
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Deploy web application firewall (WAF) rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json for total.js version or run npm list totaljsCheck Version:
npm list totaljs | grep totaljsVerify Fix Applied:
Verify total.js version is 3.4.9 or higher using npm list totaljs📡 Detection & Monitoring
Log Indicators:
- Unusual process execution patterns
- Suspicious JavaScript evaluation in logs
- Unexpected system commands from Node.js processes
Network Indicators:
- Unusual outbound connections from Node.js applications
- Suspicious payloads in HTTP requests
SIEM Query:
process.name:node.exe AND (process.cmdline:*U.set* OR process.cmdline:*U.get*) AND process.cmdline:*eval*🔗 References
- https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631
- https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
- https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607
- https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631
- https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
- https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607
