CVE-2024-45435
📋 TL;DR
CVE-2024-45435 is a prototype pollution vulnerability in Chartist.js that allows attackers to modify object prototypes, potentially leading to remote code execution or denial of service. This affects any web application using vulnerable Chartist versions for data visualization. Attackers can exploit this by injecting malicious payloads into chart data.
💻 Affected Systems
- Chartist.js
📦 What is this software?
Chartist by Chartist
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Denial of service, data manipulation, or client-side attacks affecting user sessions
If Mitigated
Limited impact with proper input validation and sandboxing
🎯 Exploit Status
Proof of concept available in GitHub gist, exploitation requires user interaction with malicious chart data
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0
Vendor Advisory: https://github.com/chartist-js/chartist/issues/1427
Restart Required: No
Instructions:
1. Update Chartist dependency to version 1.4.0 or later. 2. Run npm update chartist or yarn upgrade chartist. 3. Rebuild and redeploy application.
🔧 Temporary Workarounds
Input sanitization
allImplement strict input validation for all chart data inputs
Object.freeze workaround
allFreeze Object.prototype to prevent pollution
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Implement Content Security Policy to restrict script execution
- Isolate Chartist in sandboxed iframe with restricted permissions
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for Chartist version 1.0.0-1.3.0Check Version:
npm list chartist or grep chartist package.jsonVerify Fix Applied:
Verify Chartist version is 1.4.0 or higher in package.json📡 Detection & Monitoring
Log Indicators:
- Unusual chart data patterns
- JavaScript errors related to prototype modification
Network Indicators:
- Suspicious chart data payloads in POST requests
SIEM Query:
source=web_logs AND (chart_data CONTAINS "__proto__" OR chart_data CONTAINS "constructor")