PT-2021-21776 · Unknown · Objection.Js

Published 2021-09-06 · Updated 2022-07-29 · CVE-2021-3766

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions objection.js versions prior to 2.2.16

Description The issue concerns Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution'. This is a type of vulnerability where an attacker can modify the prototype of an object, potentially leading to unintended behavior or security issues.

Recommendations For objection.js versions prior to 2.2.16, update to version 2.2.16 to resolve the issue. As a temporary workaround, consider restricting the modification of object prototype attributes until the update is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-3766

GHSA-R659-8XFP-J327

Affected Products

Objection.Js

References · 8

• 🔥 https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc · Exploit
• https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3766 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3766 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r659-8xfp-j327 · Vendor Advisory
• https://github.com/vincit/objection.js · Note
• https://github.com/vincit/objection.js/commit/b41aab8dcd78f426f7468dcda541a7aca18a66a6 · Note
• https://t.me/cibsecurity/28294 · Telegram Post