Quick answers
- Is CVE-2021-23434 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23434 being exploited in the wild.
- How severe is CVE-2021-23434?
- Low severity, with a CVSS score of 3.1, published 1 September 2021.
- Which products and versions are affected?
- object-path (npm) before 0.11.6.
- Is there a fix for CVE-2021-23434?
- A patch was published on 2021-08-30: fix commit available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23434 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-23434?
- Check whether you run object-path (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-843) affecting object-path versions before 0.11.6. The vulnerability is a type confusion bypass: the code checks if currentPath === '__proto__' using strict equality, but when path components are arrays rather than strings, the comparison fails (e.g., ['__proto__'] !== '__proto__'), allowing the bypass of CVE-2020-15256 protections. An attacker can craft a specially-formed path using array components to pollute the Object prototype and modify properties accessible to other parts of the application. The attack requires network access and knowledge of the application's path structure but no authentication. A patch is available in version 0.11.6 and later.
Affected products
- npm object-path before 0.11.6
Identifiers
- CVE-2021-23434
- GHSA-v39p-96qg-c8rf
Timeline
- 2021-08-27: disclosed
- 2021-09-01: published
- 2021-08-30: patched: fix commit available