PT-2021-14450 · Msgpack5 · Msgpack5

Ninevra · Published 2021-03-12 · Updated 2022-10-24 · CVE-2021-21368

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 3.6.1 msgpack5 versions prior to 4.5.1 msgpack5 versions prior to 5.2.1

Description The issue occurs when msgpack5 decodes a map containing a key proto, assigning the decoded value to proto. This allows an attacker to submit crafted MessagePack data, producing values that appear to be of other types, with unexpected prototype properties and methods, or throwing unexpected exceptions. The decoded value's prototype is affected, and it can only be set to msgpack5 values. There is no effect on the global prototype.

Recommendations For versions prior to 3.6.1, update to version 3.6.1 or later. For versions prior to 4.5.1, update to version 4.5.1 or later. For versions prior to 5.2.1, update to version 5.2.1 or later. As a temporary workaround, always validate incoming data after parsing before doing any processing.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-21368

GHSA-GMJW-49P4-PCFM

Affected Products

Msgpack5

References · 9

• 🔥 https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm · Exploit
• https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8 · Patch
• https://osv.dev/vulnerability/GHSA-gmjw-49p4-pcfm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21368 · Security Note
• https://github.com/mcollina/msgpack5/releases/tag/v4.5.1 · Note
• https://github.com/mcollina/msgpack5/releases/tag/v5.2.1 · Note
• https://github.com/mcollina/msgpack5/releases/tag/v3.6.1 · Note
• https://npmjs.com/package/msgpack5 · Note