Executive brief
web3-utils is a collection of utility functions used for interacting with the Ethereum blockchain. A security flaw in its data-merging functions allows an attacker to inject malicious properties into the application's core JavaScript objects. This can lead to application crashes (Denial of Service) or unexpected changes in how the software behaves, potentially disrupting blockchain-related operations.
Technical details
The web3-utils package is vulnerable to Prototype Pollution through the mergeDeep() and format() utility functions due to insecure recursive merging of objects. An attacker can provide a specially crafted JSON object containing a '__proto__' property to the affected functions. This allows the attacker to modify the global Object prototype, which is inherited by all JavaScript objects in the application. Successful exploitation can result in a Denial of Service (DoS) by overwriting built-in methods or, in specific application contexts, potentially leading to remote code execution or privilege escalation. The issue is fixed in version 4.2.1.
Affected products
- web3.js web3-utils >=4.0.1, <4.2.1
Timeline
- 2024-02-05: disclosed: Vulnerability disclosed and introduced in Snyk database
- 2024-03-25: advisory: CVE-2024-21505 published
- 2024-03-27: patched: GitHub advisory published and fix confirmed in version 4.2.1