CVE-2024-39011

Vulnerability

The package @chargeover/redoc version 2.0.9-rc.69 is vulnerable to prototype pollution through the function mergeObjects. An attacker can pass a crafted argument containing the property __proto__ to this function, which modifies the built-in Object.prototype. This allows the attacker to inject arbitrary properties into the prototype chain of all objects. The vulnerability is reachable when the library's mergeObjects function is called with user-controlled input, such as from a JSON payload. The affected version is explicitly 2.0.9-rc.69 [1].

Exploitation

An attacker needs to supply a specially crafted object (e.g., via a JSON payload containing {"__proto__":{"test":123}}) to the mergeObjects function. No authentication or special network position is required if the application passes untrusted data to this function. The provided proof-of-concept demonstrates that calling lib.mergeObjects(emptyObj, JSON.parse('{"__proto__":{"test":123}}')) pollutes Object.prototype, as evidenced by the victim.__proto__ object gaining the test property after the attack [1].

Impact

Successful exploitation allows the attacker to modify the properties of all objects inheriting from Object.prototype. Depending on the application's use of these properties (gadgets), the impact can lead to arbitrary code execution (RCE), Denial of Service (DoS), cross-site scripting (XSS), or other unintended behaviors. The attacker can escalate the prototype pollution into more severe attacks by leveraging affected gadgets within the runtime environment [1].

Mitigation

As of the advisory publication date (2024-07-30), no patched version of @chargeover/redoc has been released. Users should monitor the vendor for a fix. If the library is not required, consider replacing it with an alternative that is not vulnerable. If immediate mitigation is needed, sanitize inputs to the mergeObjects function to prevent the __proto__ key, or avoid passing untrusted data to the function. The advisory does not list this CVE in the Known Exploited Vulnerabilities (KEV) catalog [1].