Executive brief
gRPC is a high-performance remote procedure call (RPC) framework used by applications to communicate over networks. A prototype pollution vulnerability in the loadPackageDefinition function allows attackers to modify object prototypes, potentially leading to denial of service or unexpected application behavior. Applications using affected versions of gRPC or @grpc/grpc-js could be manipulated through specially crafted package definitions.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the loadPackageDefinition function of gRPC and @grpc/grpc-js. An attacker can craft malicious package definitions that pollute the JavaScript object prototype, allowing them to inject arbitrary properties into all objects in the application. This requires network access to provide a malicious gRPC service definition; no authentication is required. The primary impact is denial of service through corruption of object properties. Patches are available in grpc 1.24.4 and @grpc/grpc-js 1.1.8.
Affected products
- gRPC grpc before 1.24.4
- gRPC @grpc/grpc-js before 1.1.8
Timeline
- 2020-11-11: disclosed: Vulnerability published in NVD
- 2020-10-23: patched: Fix merged for @grpc/grpc-js in PR #1605
- 2021-05-10: advisory: GHSA-pp75-xfpw-37g9 published