Is CVE-2021-23444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23444 being exploited in the wild.

How severe is CVE-2021-23444?

Low severity, with a CVSS score of 3.1, published 22 September 2021.

Which products and versions are affected?

jointjs (npm) SEMVER:introduced=0,fixed=3.4.2.

Is there a fix for CVE-2021-23444?

Yes. jointjs (npm): upgrade to 3.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23444 attacked?

It is attacked over the network.

Am I affected by CVE-2021-23444?

Check whether you run jointjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23444: JointJS prototype pollution in setByPath

CVE-2021-23444 · Severity: low · CVSS 3.1 · Published 2021-09-22

JointJS is a JavaScript diagramming library used to create interactive flowcharts, organizational charts, and network diagrams. A prototype pollution vulnerability in the setByPath utility function allows an attacker to modify the JavaScript object prototype, potentially leading to unexpected application behavior, data manipulation, or authentication bypass in applications that use this library.

Technologies: jointjs (npm). Vendors: npm.

Quick answers

Is CVE-2021-23444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23444 being exploited in the wild.
How severe is CVE-2021-23444?: Low severity, with a CVSS score of 3.1, published 22 September 2021.
Which products and versions are affected?: jointjs (npm) SEMVER:introduced=0,fixed=3.4.2.
Is there a fix for CVE-2021-23444?: Yes. jointjs (npm): upgrade to 3.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23444 attacked?: It is attacked over the network.
Am I affected by CVE-2021-23444?: Check whether you run jointjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jointjs (npm): upgrade to 3.4.2 or later
```
npm install jointjs@3.4.2
```

Technical details

A prototype pollution vulnerability exists in the setByPath function of JointJS versions before 3.4.2, caused by improper type handling when processing user-supplied keys as arrays in the path parameter. This issue is a type confusion bypass of a prior fix for CVE-2020-28480. An attacker can inject keys like "__proto__" or "constructor.prototype" through array parameters to pollute the Object prototype. No authentication or special privileges are required; exploitation requires network access and can be triggered if the application passes untrusted input to setByPath. Successful exploitation allows an attacker to inject or modify properties on the global Object prototype, affecting all JavaScript objects in the application context. The vulnerability was patched in version 3.4.2.

Affected products

JointJS jointjs before 3.4.2

Identifiers

CVE-2021-23444
GHSA-f3pp-32qc-36w4

Timeline

2021-09-22: disclosed
2021-09-21: patched: Version 3.4.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.