CVE-2022-24279
📋 TL;DR
CVE-2022-24279 is a prototype pollution vulnerability in madlib-object-utils package versions before 0.1.8. Attackers can exploit the setValue method to merge malicious object prototypes, potentially modifying application behavior or executing arbitrary code. This affects any application using vulnerable versions of this JavaScript utility library.
💻 Affected Systems
- madlib-object-utils
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption
Likely Case
Application manipulation leading to denial of service, data corruption, or privilege escalation
If Mitigated
Limited impact with proper input validation and sandboxing, potentially causing application errors
🎯 Exploit Status
Exploitation requires attacker-controlled input to the setValue method, which is commonly used in web applications
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.8 and later
Vendor Advisory: https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f
Restart Required: Yes
Instructions:
1. Update package.json to require madlib-object-utils version 0.1.8 or higher
2. Run 'npm update madlib-object-utils'
3. Restart all affected applications
4. Test application functionality
🔧 Temporary Workarounds
Input validation wrapper
allWrap setValue calls with input validation to reject suspicious object structures
// JavaScript code to validate inputs before calling setValue
function safeSetValue(obj, path, value) {
if (typeof path === 'string' && path.includes('__proto__') || path.includes('constructor')) {
throw new Error('Invalid path');
}
return setValue(obj, path, value);
}
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Deploy web application firewall (WAF) rules to detect and block prototype pollution attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for madlib-object-utils version <0.1.8Check Version:
npm list madlib-object-utils | grep madlib-object-utilsVerify Fix Applied:
Verify installed version is 0.1.8 or higher using npm list madlib-object-utils📡 Detection & Monitoring
Log Indicators:
- Unusual application errors related to object manipulation
- Unexpected property assignments in application logs
Network Indicators:
- HTTP requests containing __proto__ or constructor in payloads
- Unusual API calls to object manipulation endpoints
SIEM Query:
source="application_logs" AND ("__proto__" OR "constructor" OR "prototype pollution")