CVE-2021-25945
📋 TL;DR
CVE-2021-25945 is a prototype pollution vulnerability in the 'js-extend' npm package that allows attackers to modify JavaScript object prototypes, potentially leading to denial of service or remote code execution. This affects applications using vulnerable versions of js-extend (0.0.1 through 1.0.1) for object extension operations. The vulnerability is particularly dangerous in Node.js applications where user input can reach the vulnerable function.
💻 Affected Systems
- js-extend npm package
📦 What is this software?
Js Extend by Js Extend Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the environment.
Likely Case
Denial of service through application crashes or instability, with potential for limited remote code execution in specific configurations.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application errors.
🎯 Exploit Status
Exploitation requires attacker-controlled input to reach the vulnerable extend() function. Public proof-of-concept code demonstrates prototype pollution leading to denial of service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2 and later
Vendor Advisory: https://www.npmjs.com/advisories/1638
Restart Required: Yes
Instructions:
1. Update js-extend to version 1.0.2 or later using 'npm update js-extend'. 2. Restart all affected Node.js applications. 3. Verify the update with 'npm list js-extend'.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to prevent malicious objects from reaching the extend() function.
Use Alternative Libraries
allReplace js-extend with safer alternatives like lodash.merge or Object.assign with proper validation.
npm uninstall js-extend
npm install lodash
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all data passed to js-extend functions
- Isolate affected applications in network segments with limited access and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list js-extend' to see if version is between 0.0.1 and 1.0.1 inclusive.Check Version:
npm list js-extend | grep js-extendVerify Fix Applied:
Verify js-extend version is 1.0.2 or higher using 'npm list js-extend' and test object extension with known safe inputs.📡 Detection & Monitoring
Log Indicators:
- Application crashes or unexpected behavior when processing object extensions
- Unusual prototype modifications in JavaScript error logs
Network Indicators:
- Unusual outbound connections from Node.js processes
- Requests containing specially crafted JSON objects
SIEM Query:
source="application.log" AND ("js-extend" OR "extend()") AND ("crash" OR "error" OR "unexpected")