CVE-2021-41097
📋 TL;DR
CVE-2021-41097 is a prototype pollution vulnerability in aurelia-path versions before 1.1.7 that allows attackers to modify the Object prototype through specially crafted input. This affects Aurelia applications using aurelia-path for path parsing, particularly those employing aurelia-router. Successful exploitation could lead to denial of service, remote code execution, or other security impacts depending on the application.
💻 Affected Systems
- aurelia-path
📦 What is this software?
Aurelia Path by Bluespire
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption
Likely Case
Denial of service, application instability, or limited privilege escalation within the application context
If Mitigated
No impact if patched or proper input validation prevents malicious payloads
🎯 Exploit Status
Example exploit URL provided in advisory: https://aurelia.io/blog/?__proto__[asdf]=asdf
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.7
Vendor Advisory: https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
Restart Required: Yes
Instructions:
1. Update package.json to specify 'aurelia-path': '^1.1.7' 2. Run 'npm update aurelia-path' or 'yarn upgrade aurelia-path' 3. Restart the application
🔧 Temporary Workarounds
Input validation/sanitization
allImplement strict input validation to reject URLs containing __proto__ or similar prototype pollution patterns
🧯 If You Can't Patch
- Implement WAF rules to block requests containing __proto__ patterns
- Isolate affected applications behind reverse proxies with request filtering
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/aurelia-path/package.json for version <1.1.7Check Version:
npm list aurelia-path | grep aurelia-pathVerify Fix Applied:
Confirm version 1.1.7 or higher is installed in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing __proto__ patterns in query parameters or URLs
- Application errors related to prototype modification
Network Indicators:
- HTTP requests with __proto__ in query strings
- Unusual patterns in URL parsing
SIEM Query:
http.uri_query contains "__proto__"🔗 References
- https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1
- https://github.com/aurelia/path/issues/44
- https://github.com/aurelia/path/releases/tag/1.1.7
- https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
- https://www.npmjs.com/package/aurelia-path
- https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1
- https://github.com/aurelia/path/issues/44
- https://github.com/aurelia/path/releases/tag/1.1.7
- https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
- https://www.npmjs.com/package/aurelia-path
