CVE-2024-38996
📋 TL;DR
This CVE describes a prototype pollution vulnerability in ag-grid-community and ag-grid-enterprise versions 31.3.2 via the _.mergeDeep function. Attackers can inject arbitrary properties to execute arbitrary code or cause Denial of Service. Any application using these vulnerable versions is affected.
💻 Affected Systems
- ag-grid-community
- ag-grid-enterprise
📦 What is this software?
Ag Grid by Ag Grid
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of Service causing application crashes or instability, potentially leading to data corruption.
If Mitigated
Limited impact if input validation and sanitization are implemented, though risk remains.
🎯 Exploit Status
Proof-of-concept code is publicly available in the provided gists, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 31.3.3 or later
Vendor Advisory: https://www.ag-grid.com/changelog/
Restart Required: Yes
Instructions:
1. Update ag-grid-community and ag-grid-enterprise to version 31.3.3 or later. 2. Run 'npm update ag-grid-community ag-grid-enterprise' or equivalent package manager command. 3. Restart the application server.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject any unexpected properties in objects passed to _.mergeDeep.
Use Object.freeze on Prototypes
allFreeze Object.prototype to prevent prototype pollution, though this may break legitimate functionality.
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) to limit script execution.
- Use web application firewall (WAF) rules to block malicious payloads targeting prototype pollution.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for ag-grid-community and ag-grid-enterprise version 31.3.2.Check Version:
npm list ag-grid-community ag-grid-enterpriseVerify Fix Applied:
Verify that ag-grid-community and ag-grid-enterprise are updated to version 31.3.3 or later in package.json.📡 Detection & Monitoring
Log Indicators:
- Unusual error logs related to prototype pollution or unexpected object properties.
- Application crashes or abnormal termination logs.
Network Indicators:
- HTTP requests containing malicious payloads with __proto__ or constructor properties.
SIEM Query:
search 'ag-grid' AND ('prototype pollution' OR 'mergeDeep' OR 'CVE-2024-38996') in application logs🔗 References
- https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
- https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
- https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
- https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
- https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
- https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
