Listen to this Post
The vulnerability exists in the `mergeDeep` utility function when processing validation results from multiple standalone schemas. When a route uses at least two `standalone` schema validations on the same key (e.g., via .guard()), and one schema uses z.any(), the merging order becomes crucial. An attacker can submit a JSON payload containing a `__proto__` property. Due to the specific order of operations when merging the validation results from the different schemas, the `__proto__` property is not properly sanitized and is merged into the target object. This pollutes the Object prototype, allowing the injection of arbitrary properties onto all objects in the application. When chained with a separate code execution vector (GHSA-8vch-m3f4-q8jf), this prototype pollution can lead to full Remote Code Execution.
Platform: Elysia.js
Version: < 1.4.17
Vulnerability: Prototype Pollution
Severity: Critical
Date:
Prediction: Patched 2024
What Undercode Say:
Analytics
npm list elysia grep -r ".guard" src/ grep -r "z.any()" src/
// Example of vulnerable pattern
.guard({ schema: "standalone", body: z.object({ data: z.any() }) })
.post("/", handler, { body: z.object({ data: z.object({ messageId: z.string() }) }) })
How Exploit:
curl -X POST http://target/ -H "Content-Type: application/json" -d '{"data":{"<strong>proto</strong>":{"polluted":"yes"}}}'
// Payload to set a malicious property on all objects
{"data":{"<strong>proto</strong>":{"shell":"true"}}}
Protection from this CVE
Update to version 1.4.17 immediately. Apply the provided workaround plugin to strip `__proto__` keys from incoming JSON requests. Avoid using `z.any()` in standalone validation guards alongside other validations for the same route.
Impact:
Remote Code Execution, System Compromise, Arbitrary Property Injection, Application Instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
