PT-2022-11644 · Linkedin · Dustjs

Baiyecha404 · CVE-2021-4264 · Published 2022-12-21 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LinkedIn dustjs versions up to 2.x LinkedIn dustjs version 3.0.0

Description A vulnerability was found in LinkedIn dustjs, allowing for improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. This issue can be exploited remotely. The exploit has been disclosed to the public.

Recommendations For LinkedIn dustjs versions up to 2.x, upgrade to version 3.0.0 to address this issue. For LinkedIn dustjs version 3.0.0, upgrade to version 3.0.1 to address this issue.

Exploit

Fix

Special Elements Injection

Code Injection

Prototype Pollution

Weakness Enumeration

CWE-74

CWE-94

CWE-1321

Related Identifiers

CVE-2021-4264

GHSA-C6RP-WRP9-QR4Q

Affected Products

Dustjs

References · 13

• 🔥 https://github.com/linkedin/dustjs/issues/804 · Exploit
• 🔥 https://github.com/linkedin/dustjs/pull/805 · Exploit
• https://github.com/linkedin/dustjs/commit/ddb6523832465d38c9d80189e9de60519ac307c3 · Patch
• https://github.com/linkedin/dustjs/releases/tag/v3.0.0 · Patch
• https://osv.dev/vulnerability/CVE-2021-4264 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6rp-wrp9-qr4q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4264 · Security Note
• https://github.com/linkedin/dustjs · Note
• https://vuldb.com/?ctiid.216464 · Note
• https://t.me/cibsecurity/55072 · Telegram Post
• https://vuldb.com/?id.216464 · Note
• https://t.me/cvenotify/40377 · Telegram Post
• https://t.me/cvenotify/40653 · Telegram Post