CVE-2021-3757
📋 TL;DR
CVE-2021-3757 is a prototype pollution vulnerability in the immer JavaScript library that allows attackers to modify object prototypes, potentially leading to denial of service, remote code execution, or privilege escalation. This affects any application using vulnerable versions of immer for state management. The vulnerability is particularly dangerous in Node.js applications and frontend frameworks that use immer.
💻 Affected Systems
- immer
- applications using immer library
📦 What is this software?
Immer by Immer Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service through application crashes or privilege escalation by modifying application logic.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application instability.
🎯 Exploit Status
Exploitation requires attacker-controlled input to immer functions. Public proof-of-concept demonstrates prototype pollution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: immer 9.0.6 and later
Vendor Advisory: https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237
Restart Required: Yes
Instructions:
1. Update package.json to use immer >=9.0.6. 2. Run 'npm update immer' or 'yarn upgrade immer'. 3. Restart the application. 4. Test application functionality.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation for all data passed to immer functions
Object.freeze on prototypes
allFreeze Object.prototype and other base prototypes to prevent modification
Object.freeze(Object.prototype);
Object.freeze(Array.prototype);
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) to limit script execution
- Deploy web application firewall (WAF) rules to detect and block prototype pollution attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for immer version <9.0.6. Run 'npm list immer' or check node_modules/immer/package.json.Check Version:
npm list immer | grep immer or node -e "console.log(require('immer/package.json').version)"Verify Fix Applied:
Confirm immer version is >=9.0.6. Test application with known safe inputs to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Memory consumption spikes
Network Indicators:
- Requests with specially crafted JSON payloads
- Unusual patterns in API calls to state management endpoints
SIEM Query:
source="application.logs" AND ("immer" OR "prototype") AND ("crash" OR "error" OR "unexpected")