Quick answers
- Is CVE-2024-36577 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-36577 being exploited in the wild.
- How severe is CVE-2024-36577?
- Low severity, with a CVSS score of 3.1, published 17 June 2024.
- Which products and versions are affected?
- ApPHP Object-Resolver < 3.1.1; @apphp/object-resolver (npm) SEMVER:introduced=0,fixed=3.1.1.
- Is there a fix for CVE-2024-36577?
- Yes. @apphp/object-resolver (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-36577 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-36577?
- Check whether you run ApPHP Object-Resolver or @apphp/object-resolver (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @apphp/object-resolver (npm): upgrade to 3.1.1 or later
npm install @apphp/object-resolver@3.1.1
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the Module.setNestedProperty function of @apphp/object-resolver versions before 3.1.1. The function failed to properly validate path inputs, allowing attackers to set properties on Object.prototype or other built-in prototypes via special key sequences (e.g., "__proto__", "constructor", "prototype"). An attacker with the ability to control the path parameter can pollute the prototype chain, affecting all objects in the application. The attack vector is network-based if the library processes untrusted user input. The vulnerability was fixed in version 3.1.1 via commit 7e347a2, which added type checking and validation for the path parameter.
Affected products
- AppHP object-resolver < 3.1.1
Identifiers
- CVE-2024-36577
- GHSA-qj86-v6m7-4qv2
Timeline
- 2024-06-17: disclosed
- 2024-04-06: patched: Fix committed; version 3.1.1 released