CVE-2021-25952
📋 TL;DR
This is a prototype pollution vulnerability in the 'just-safe-set' npm package that allows attackers to modify object prototypes, potentially leading to denial of service or remote code execution. It affects applications using vulnerable versions of this package, particularly Node.js applications that process untrusted user input.
💻 Affected Systems
- just-safe-set npm package
📦 What is this software?
Just Safe Set by Just Safe Set Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service through application crashes or instability, potentially leading to data corruption.
If Mitigated
Limited impact with proper input validation and sandboxing, though prototype pollution can bypass some controls.
🎯 Exploit Status
Prototype pollution vulnerabilities are well-understood and often weaponized. The CVSS 9.8 score indicates critical severity with low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.2 and later
Vendor Advisory: https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53
Restart Required: Yes
Instructions:
1. Update package.json to require 'just-safe-set' version '^2.2.2' or later. 2. Run 'npm update just-safe-set' or 'yarn upgrade just-safe-set'. 3. Restart your application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to prevent malicious object property names from reaching vulnerable functions.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled data
- Use application sandboxing or containerization to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for 'just-safe-set' version between 1.0.0 and 2.2.1 inclusive.Check Version:
npm list just-safe-setVerify Fix Applied:
Verify 'just-safe-set' version is 2.2.2 or higher in package.json and node_modules.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual memory usage patterns
- Suspicious property assignments in logs
Network Indicators:
- Unusual outbound connections from Node.js processes
- Anomalous payloads containing '__proto__' or similar patterns
SIEM Query:
source="application_logs" AND ("just-safe-set" OR "prototype pollution" OR "__proto__")🔗 References
- https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25952
- https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25952
