CVE-2021-23460
📋 TL;DR
This vulnerability allows attackers to perform prototype pollution attacks via the 'set' method in min-dash, enabling them to modify object prototypes and potentially execute arbitrary code. It affects applications using vulnerable versions of the min-dash library, particularly those that process untrusted user input through the affected function.
💻 Affected Systems
- min-dash library
📦 What is this software?
Min Dash by Camunda
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption through prototype pollution that modifies application behavior.
Likely Case
Application instability, denial of service, or limited data manipulation through prototype pollution affecting specific functionality.
If Mitigated
Minimal impact if input validation and sanitization prevent malicious payloads from reaching the vulnerable function.
🎯 Exploit Status
Exploitation requires the application to use the vulnerable 'set' method with attacker-controlled input. Public proof-of-concept exists in GitHub pull requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.1
Vendor Advisory: https://github.com/bpmn-io/min-dash/pull/21
Restart Required: No
Instructions:
1. Update min-dash dependency to version 3.8.1 or later. 2. For npm: run 'npm update min-dash'. 3. For yarn: run 'yarn upgrade min-dash'. 4. Verify the update in package.json shows min-dash >=3.8.1.
🔧 Temporary Workarounds
Input validation wrapper
allWrap calls to min-dash's 'set' method with input validation to reject non-string keys
Implement custom validation function that checks key types before calling set()
🧯 If You Can't Patch
- Implement strict input validation for all data passed to min-dash's 'set' method
- Use object.freeze() on critical prototypes to prevent pollution
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for min-dash version <3.8.1Check Version:
npm list min-dash | grep min-dashVerify Fix Applied:
Confirm min-dash version is >=3.8.1 in package.json and verify the set method now validates key types📡 Detection & Monitoring
Log Indicators:
- Unusual application crashes or errors related to object manipulation
- Unexpected prototype modifications in debug logs
Network Indicators:
- Unusual HTTP requests containing prototype pollution payloads
SIEM Query:
Search for patterns like '__proto__', 'constructor', or 'prototype' in user input fields🔗 References
- https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32
- https://github.com/bpmn-io/min-dash/pull/21
- https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127
- https://snyk.io/vuln/SNYK-JS-MINDASH-2340605
- https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32
- https://github.com/bpmn-io/min-dash/pull/21
- https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127
- https://snyk.io/vuln/SNYK-JS-MINDASH-2340605
