CVE-2021-42581
📋 TL;DR
CVE-2021-42581 is a prototype pollution vulnerability in Ramda's mapObjIndexed function that allows attackers to modify JavaScript object prototypes by supplying crafted objects containing '__proto__' properties. This affects applications using Ramda 0.27.0 or earlier, potentially compromising application integrity or availability. The vendor disputes the severity, arguing it only allows users to create objects with custom prototypes they didn't anticipate.
💻 Affected Systems
- Ramda
📦 What is this software?
Ramda by Ramdajs
⚠️ Risk & Real-World Impact
Worst Case
Complete application compromise through prototype pollution leading to remote code execution, denial of service, or data corruption.
Likely Case
Application instability, unexpected behavior, or denial of service through prototype chain manipulation.
If Mitigated
Limited impact with proper input validation and sanitization in place.
🎯 Exploit Status
Public proof-of-concept available via provided jsfiddle links. Exploitation requires attacker to control input to mapObjIndexed function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.27.1 and later
Vendor Advisory: https://github.com/ramda/ramda/pull/3192
Restart Required: No
Instructions:
1. Update Ramda dependency to version 0.27.1 or later. 2. Run 'npm update ramda' or 'yarn upgrade ramda'. 3. Test application functionality after update.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to reject objects containing '__proto__' properties before passing to mapObjIndexed.
Object.freeze on Object.prototype
allPrevent prototype pollution by freezing Object.prototype (may break legitimate functionality).
Object.freeze(Object.prototype)
🧯 If You Can't Patch
- Implement strict input validation to reject objects with '__proto__' properties
- Use alternative functions that don't have prototype pollution issues
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for Ramda version 0.27.0 or earlier.Check Version:
npm list ramda | grep ramdaVerify Fix Applied:
Verify Ramda version is 0.27.1 or later in package.json and node_modules.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Prototype-related errors
Network Indicators:
- Requests containing '__proto__' in payloads
SIEM Query:
search '__proto__' in web application logs or payloads