CVE-2021-3805
📋 TL;DR
CVE-2021-3805 is a prototype pollution vulnerability in the object-path npm package that allows attackers to modify JavaScript object prototypes, potentially leading to denial of service, remote code execution, or privilege escalation. This affects any application using vulnerable versions of object-path, particularly Node.js applications and web services. The vulnerability is exploitable when user-controlled input reaches object-path's set or del methods.
💻 Affected Systems
- object-path npm package
📦 What is this software?
Object Path by Object Path Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Denial of service through application crashes or unexpected behavior, potentially enabling privilege escalation in multi-user environments.
If Mitigated
Limited impact with proper input validation and sandboxing, though prototype pollution can bypass some security controls.
🎯 Exploit Status
Proof-of-concept exploits are publicly available. Exploitation requires user input to reach vulnerable functions, which is common in many applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.8 and later
Vendor Advisory: https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6
Restart Required: Yes
Instructions:
1. Update object-path to version 0.11.8 or later using npm update object-path. 2. Restart all affected Node.js applications. 3. Test application functionality after update.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to prevent prototype pollution payloads from reaching object-path functions.
Object.freeze on prototypes
allFreeze Object.prototype and other critical prototypes to prevent modification.
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs that interact with object-path.
- Use security monitoring to detect prototype pollution attempts and isolate affected systems.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list object-path to see if version is below 0.11.8.Check Version:
npm list object-path | grep object-pathVerify Fix Applied:
Confirm object-path version is 0.11.8 or higher using npm list object-path.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual prototype modification attempts in logs
- Error messages related to object-path
Network Indicators:
- Requests containing __proto__ or constructor payloads
- Unusual patterns in API calls to affected endpoints
SIEM Query:
search for 'object-path' AND ('error' OR 'crash' OR '__proto__') in application logs🔗 References
- https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6
- https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
- https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6
- https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
