protobuf.js up to 7.2.3 prototype pollution

Summaryinfo

A vulnerability categorized as problematic has been discovered in protobuf.js up to 7.2.3. Impacted is an unknown function. Executing a manipulation can lead to prototype pollution. This vulnerability is handled as CVE-2023-36665. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in protobuf.js up to 7.2.3 (JavaScript Library) and classified as problematic. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect integrity. CVE summarizes:

protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about "Object.constructor.prototype. = ...;" whereas CVE-2022-25878 was about "Object.__proto__. = ...;" instead.

The weakness was released 07/05/2023. The advisory is shared for download at code-intelligence.com. This vulnerability was named CVE-2023-36665 since 06/25/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 7.2.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch e66379f451b0393c27d87b37fa7d271619e16b0d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-2072). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• protobuf.js

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion