CVE-2023-2972
📋 TL;DR
CVE-2023-2972 is a prototype pollution vulnerability in antfu/utils library versions prior to 0.7.3. This allows attackers to inject properties into JavaScript objects, potentially leading to remote code execution, denial of service, or privilege escalation. Anyone using vulnerable versions of this utility library in their Node.js applications is affected.
💻 Affected Systems
- antfu/utils
📦 What is this software?
Utils by Antfu
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service, application crashes, or limited data manipulation depending on how the library is used.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application instability.
🎯 Exploit Status
Prototype pollution vulnerabilities are well-understood and often easily exploitable with public proof-of-concepts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.3 and later
Vendor Advisory: https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682
Restart Required: Yes
Instructions:
1. Update package.json to use antfu/utils version 0.7.3 or higher. 2. Run 'npm update antfu/utils' or 'yarn upgrade antfu/utils'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input Validation Wrapper
allWrap vulnerable functions with input validation to reject malicious payloads
Object.freeze Prototype
allFreeze Object.prototype to prevent property injection
Object.freeze(Object.prototype)
🧯 If You Can't Patch
- Implement strict input validation for all user-controlled data passed to antfu/utils functions
- Use application-level firewalls or WAF rules to block suspicious object manipulation patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for antfu/utils version. If version is less than 0.7.3, you are vulnerable.Check Version:
npm list antfu/utils | grep antfu/utils || yarn list antfu/utils | grep antfu/utilsVerify Fix Applied:
After updating, verify the installed version is 0.7.3 or higher using 'npm list antfu/utils' or 'yarn list antfu/utils'.📡 Detection & Monitoring
Log Indicators:
- Unusual object property modifications
- Application crashes with prototype-related errors
- Unexpected function executions
Network Indicators:
- HTTP requests with specially crafted JSON payloads
- Unusual API calls to utility functions
SIEM Query:
source="application.logs" AND ("prototype" OR "__proto__") AND ("antfu" OR "utils")