CVE-2021-3766
📋 TL;DR
CVE-2021-3766 is a prototype pollution vulnerability in objection.js that allows attackers to modify object prototypes, potentially leading to remote code execution or denial of service. This affects applications using vulnerable versions of objection.js, particularly those that process untrusted user input through the library's functions.
💻 Affected Systems
- objection.js
📦 What is this software?
Objection by Objection Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Denial of service, privilege escalation, or data manipulation through prototype pollution.
If Mitigated
Limited impact with proper input validation and sanitization in place.
🎯 Exploit Status
Exploitation requires sending specially crafted input to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.18 and later
Vendor Advisory: https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
Restart Required: Yes
Instructions:
1. Update objection.js to version 2.2.18 or later using npm update objection. 2. Restart the application to apply changes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all user-provided data before processing with objection.js.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs.
- Use web application firewalls (WAF) to filter malicious payloads targeting prototype pollution.
🔍 How to Verify
Check if Vulnerable:
Check package.json for objection.js version. If version is below 2.2.18, the system is vulnerable.Check Version:
npm list objectionVerify Fix Applied:
Verify objection.js version is 2.2.18 or higher in package.json after update.📡 Detection & Monitoring
Log Indicators:
- Unusual object property modifications, unexpected prototype changes, or error logs related to object manipulation.
Network Indicators:
- HTTP requests with specially crafted JSON payloads targeting objection.js endpoints.
SIEM Query:
Search for HTTP requests containing '__proto__' or 'constructor' in payloads to objection.js endpoints.🔗 References
- https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
- https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc
- https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
- https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc
