PT-2021-14403 · Dynamoose · Dynamoose

Fishcharlie · Published 2021-02-08 · Updated 2022-10-25 · CVE-2021-21304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dynamoose versions 2.0.0 through 2.6.0

Description: Dynamoose is an open-source modeling tool for Amazon's DynamoDB. A prototype pollution vulnerability was found in the internal utility method lib/utils/object/set.ts, which is used throughout the codebase for various operations. There is no evidence that this vulnerability has been exploited. The issue does not impact versions 1.x.x, as the vulnerable method was added in the v2 rewrite. It also affects v2.x.x beta/alpha versions.

Recommendations: For Dynamoose versions 2.0.0 through 2.6.0, update to version 2.7.0 or greater to patch the vulnerability. As a temporary workaround, consider restricting the use of the lib/utils/object/set.ts method until a patch is applied.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-21304

GHSA-RRQM-P222-8PH2

Affected Products

Dynamoose

References · 10

• https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e · Patch
• https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2 · Patch
• https://osv.dev/vulnerability/GHSA-rrqm-p222-8ph2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21304 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21304 · Vendor Advisory
• https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0 · Note
• https://github.com/dynamoose/dynamoose · Note
• https://t.me/cibsecurity/23223 · Telegram Post
• https://npmjs.com/package/dynamoose · Note
• https://t.me/cvenotify/19739 · Telegram Post