CVE-2024-36572
📋 TL;DR
This CVE describes a prototype pollution vulnerability in allpro form-manager version 0.7.4 that allows attackers to inject arbitrary properties into JavaScript objects, potentially leading to remote code execution. Attackers can exploit this via the setDefaults, mergeBranch, and Object.setObjectValue functions. Any application using this vulnerable version of form-manager is affected.
💻 Affected Systems
- allpro form-manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary code execution in the context of the application, potentially allowing privilege escalation and unauthorized access to sensitive data.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though prototype pollution could still cause application instability.
🎯 Exploit Status
Proof of concept code is publicly available in the GitHub gist references, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Remove or replace form-manager 0.7.4 with a secure alternative.
🔧 Temporary Workarounds
Remove vulnerable package
allUninstall form-manager 0.7.4 and replace with alternative form management solution
npm uninstall form-manager
Input validation wrapper
allImplement strict input validation for all user inputs passed to form-manager functions
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Isolate the application in a container or sandbox to limit potential damage from exploitation
🔍 How to Verify
Check if Vulnerable:
Check package.json for form-manager version 0.7.4 or run: npm list form-managerCheck Version:
npm list form-managerVerify Fix Applied:
Verify form-manager is no longer installed or is replaced with a different version📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript object property modifications
- Unexpected function calls to setDefaults, mergeBranch, or Object.setObjectValue
- Application crashes or abnormal behavior
Network Indicators:
- Unusual HTTP requests containing JavaScript object manipulation patterns
- Requests with unexpected property names in payloads
SIEM Query:
Search for application logs containing references to form-manager, setDefaults, mergeBranch, or Object.setObjectValue with suspicious payloads