Junglewise Threat Intelligence

CVE-2024-39001: ag-grid Prototype Pollution in multiple components

CVE-2024-39001 · Severity: low · CVSS 3.1 · Published 2024-07-01

Executive brief

Multiple ag-grid packages, which provide high-performance data grid and charting components for web applications, are vulnerable to a security flaw that allows attackers to manipulate core application objects. By injecting malicious properties into the application's memory, an attacker could potentially cause the application to crash or execute unauthorized code. This could lead to service disruptions or the compromise of user data within the affected web application.

Technical details

A Prototype Pollution vulnerability exists in ag-grid-community, ag-grid-enterprise, and related charting packages due to improper input validation in several internal functions including _ModuleSupport.jsonApply, _ModuleSupport.setPath, _Util.jsonApply, and _.mergeDeep. An attacker with the ability to provide specially crafted JSON input containing the __proto__ property can modify the base Object prototype. This can be leveraged to alter application logic, cause a Denial of Service, or achieve Remote Code Execution depending on the available gadgets in the environment. The vulnerability is reachable via network requests if the application passes user-controlled data to these vulnerable utility functions. Patches have been released in versions 31.3.4 and 32.0.1 (and 32.0.2 for some components).

Affected products

  • ag-grid ag-grid-community < 31.3.4, 32.0.0
  • ag-grid ag-grid-enterprise < 31.3.4, 32.0.0
  • ag-grid @ag-grid-enterprise/charts < 31.3.4, 32.0.0
  • ag-grid ag-charts-community < 9.3.2, 10.0.0

Timeline

  • 2024-07-01: disclosed
  • 2024-07-01: advisory
  • 2024-07-12: patched: GitHub advisory reviewed and updated with patch info

References