Is CVE-2020-7768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7768 being exploited in the wild.

How severe is CVE-2020-7768?

Low severity, with a CVSS score of 3.1, published 10 May 2021.

Which products and versions are affected?

Grpc before 1.24.4; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.1.8.

Is there a fix for CVE-2020-7768?

Yes. @grpc/grpc-js (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7768 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-7768?

Check whether you run Grpc or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7768: gRPC prototype pollution in loadPackageDefinition

CVE-2020-7768 · Severity: low · CVSS 3.1 · Published 2021-05-10

gRPC is a high-performance remote procedure call (RPC) framework used by applications to communicate over networks. A prototype pollution vulnerability in the loadPackageDefinition function allows attackers to modify object prototypes, potentially leading to denial of service or unexpected application behavior. Applications using affected versions of gRPC or @grpc/grpc-js could be manipulated through specially crafted package definitions.

Technologies: Grpc, @grpc/grpc-js (npm). Vendors: Grpc, npm.

Quick answers

Is CVE-2020-7768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7768 being exploited in the wild.
How severe is CVE-2020-7768?: Low severity, with a CVSS score of 3.1, published 10 May 2021.
Which products and versions are affected?: Grpc before 1.24.4; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.1.8.
Is there a fix for CVE-2020-7768?: Yes. @grpc/grpc-js (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7768 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-7768?: Check whether you run Grpc or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@grpc/grpc-js (npm): upgrade to 1.1.8 or later
```
npm install @grpc/grpc-js@1.1.8
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the loadPackageDefinition function of gRPC and @grpc/grpc-js. An attacker can craft malicious package definitions that pollute the JavaScript object prototype, allowing them to inject arbitrary properties into all objects in the application. This requires network access to provide a malicious gRPC service definition; no authentication is required. The primary impact is denial of service through corruption of object properties. Patches are available in grpc 1.24.4 and @grpc/grpc-js 1.1.8.

Affected products

gRPC grpc before 1.24.4
gRPC @grpc/grpc-js before 1.1.8

Identifiers

CVE-2020-7768
GHSA-pp75-xfpw-37g9

Timeline

2020-11-11: disclosed: Vulnerability published in NVD
2020-10-23: patched: Fix merged for @grpc/grpc-js in PR #1605
2021-05-10: advisory: GHSA-pp75-xfpw-37g9 published

References

https://github.com/grpc/grpc-node/pull/1605

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.