PT-2021-22477 · Apache · Apache Echarts

Lowpissang · Published 2021-09-17 · Updated 2022-09-10 · CVE-2021-39227

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZRender versions prior to 5.2.1 Apache ECharts versions prior to 5.2.1

Description The issue results in prototype pollution when using merge and clone helper methods in the src/core/util.ts module. It affects Apache ECharts, which uses and exports these methods directly. A proof of concept is available on the GitHub Security Advisory page.

Recommendations For ZRender versions prior to 5.2.1, update to version 5.2.1. For Apache ECharts versions prior to 5.2.1, update to version 5.2.1. As a temporary workaround, check if there is proto in the object keys and omit it before using it as a parameter in the affected methods, such as echarts.util.merge and setOption.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-39227

GHSA-FHV8-FX5F-7FXF

Affected Products

Apache Echarts

References · 9

• https://github.com/ecomfe/zrender/pull/826 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39227 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39227 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fhv8-fx5f-7fxf · Vendor Advisory
• https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf · Note
• https://github.com/ecomfe/zrender/releases/tag/5.2.1 · Note
• https://github.com/ecomfe/zrender · Note
• https://t.me/cibsecurity/29048 · Telegram Post
• https://t.me/cvenotify/21090 · Telegram Post