Junglewise Threat Intelligence

CVE-2024-32866: Conform prototype pollution in parseWith functions

CVE-2024-32866 · Severity: low · CVSS 3.1 · Published 2024-04-23

Executive brief

Conform is a React form library used to build HTML forms with validation. A prototype pollution vulnerability in its form data parsing functions allows attackers to inject malicious code that modifies JavaScript object prototypes, potentially compromising the integrity of the application and affecting all JavaScript objects in the application's runtime.

Technical details

The vulnerability is a prototype pollution issue (CWE-1321) in the form data parsing logic, specifically in the formdata.ts file (line 117). The parseWithZod, parseWithYup, and similar functions process nested object keys but lack proper validation to prevent accessing the __proto__ property. When an attacker supplies input with keys like "__proto__.pollution", the code creates or modifies a path through the prototype chain without checking if the target key is safe. The vulnerability is triggered during server-side or client-side validation of form data and URL parameters. No authentication or user interaction is required—a network attacker can send crafted form data to trigger the issue. Successful exploitation allows modification of shared object prototypes, potentially leading to property poisoning, denial of service, or code execution depending on how the application uses objects. The vulnerability affects versions <= 1.1.0 for the main branches and all prior versions of affected packages; patches are available in versions 1.1.1 and 0.9.2.

Affected products

  • Edmund Hung @conform-to/dom <= 1.1.0, all versions prior to 0.9.2
  • Edmund Hung @conform-to/zod <= 1.1.0, all versions prior to 0.9.2
  • Edmund Hung @conform-to/yup <= 1.1.0, all versions prior to 0.9.2

Timeline

  • 2024-04-23: disclosed: Vulnerability published as GHSA-624g-8qjg-8qxf and CVE-2024-32866
  • 2024-04-23: patched: Fixed in @conform-to/dom 1.1.1, @conform-to/zod 1.1.1, @conform-to/yup 1.1.1, and 0.9.2 branches

References