CVE-2021-25953
📋 TL;DR
CVE-2021-25953 is a prototype pollution vulnerability in the 'putil-merge' npm package that allows attackers to modify object prototypes, potentially leading to denial of service or remote code execution. This affects any application using vulnerable versions of this utility library for object merging operations. The vulnerability is particularly dangerous because it can be exploited through user-controlled input.
💻 Affected Systems
- putil-merge npm package
📦 What is this software?
Putil Merge by Putil Merge Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Denial of service through application crashes or instability, with potential for limited code execution in specific configurations.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application errors.
🎯 Exploit Status
Exploitation requires the application to process attacker-controlled objects through the merge function. Public proof-of-concept code demonstrates the prototype pollution technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.7 and later
Vendor Advisory: https://www.npmjs.com/advisories/1665
Restart Required: Yes
Instructions:
1. Update package.json to specify 'putil-merge': '^3.6.7' or higher. 2. Run 'npm update putil-merge' or 'npm install putil-merge@latest'. 3. Restart all Node.js applications using this package.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to prevent prototype pollution by filtering or rejecting objects with __proto__ or constructor properties.
Use Object.freeze on Object.prototype
allPrevent prototype pollution by freezing Object.prototype before processing untrusted data.
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Implement strict input validation to reject objects containing __proto__ or constructor properties.
- Use alternative object merging libraries that are not vulnerable, such as lodash.merge with proper configuration.
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for putil-merge version. Run 'npm list putil-merge' to see installed version.Check Version:
npm list putil-merge | grep putil-mergeVerify Fix Applied:
Verify version is 3.6.7 or higher with 'npm list putil-merge'. Test with known safe objects to ensure merge functionality works without prototype pollution.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Errors related to prototype chain
Network Indicators:
- HTTP requests containing __proto__ or constructor in JSON payloads
- Unusual object structures in API calls
SIEM Query:
source=application_logs AND ("__proto__" OR "constructor") AND "putil-merge"