CVE-2024-12629
📋 TL;DR
This CVE describes a prototype pollution vulnerability in Progress Telerik KendoReact components where attackers can inject malicious properties into global prototypes. This can lead to denial of service or command injection attacks. Organizations using KendoReact versions v3.5.0 through v9.4.0 in their React applications are affected.
💻 Affected Systems
- Progress Telerik KendoReact UI components
📦 What is this software?
Kendoreact by Progress
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing application crashes or instability, potentially disrupting business operations.
If Mitigated
Limited impact with proper input validation and security controls in place.
🎯 Exploit Status
Exploitation requires understanding of prototype pollution techniques and access to user input vectors in the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v9.5.0 and later
Vendor Advisory: https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-protoype-pollution-2024-12629
Restart Required: No
Instructions:
1. Update KendoReact package to v9.5.0 or later using npm or yarn. 2. Run npm update @progress/kendo-react-* or yarn upgrade @progress/kendo-react-*. 3. Rebuild and redeploy your React application.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation and sanitization for all user-controlled data before processing by KendoReact components.
Object.freeze on prototypes
allUse Object.freeze() on critical prototype objects to prevent property injection.
Object.freeze(Object.prototype);
Object.freeze(Array.prototype);
🧯 If You Can't Patch
- Implement WAF rules to detect and block prototype pollution patterns in HTTP requests.
- Isolate vulnerable applications in network segments with restricted access and monitor for anomalous behavior.
🔍 How to Verify
Check if Vulnerable:
Check package.json for @progress/kendo-react-* dependencies with versions between 3.5.0 and 9.4.0 inclusive.Check Version:
npm list @progress/kendo-react-* | grep @progress/kendo-react-Verify Fix Applied:
Verify package.json shows @progress/kendo-react-* dependencies at version 9.5.0 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual application crashes or restarts
- Error logs containing prototype-related JavaScript errors
- Unexpected property assignments in object logs
Network Indicators:
- HTTP requests with unusual property names in JSON payloads
- Requests containing __proto__ or constructor properties
SIEM Query:
source="application_logs" AND ("prototype" OR "__proto__" OR "constructor") AND severity="ERROR"