PT-2022-11920 · Unknown · Oroplatform

Rgrebenchuk · Published 2022-01-04 · Updated 2022-01-12 · CVE-2021-43852

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions OroPlatform versions prior to 4.2.8

Description The issue allows an attacker to inject properties into existing JavaScript language construct prototypes, such as objects, by sending a specially crafted request. This injection may lead to JavaScript code execution by libraries that are vulnerable to Prototype Pollution.

Recommendations For versions prior to 4.2.8, update to version 4.2.8 to resolve the issue. As a temporary workaround, consider configuring a firewall or WAF to drop requests containing strings: proto, constructor[prototype], and constructor.prototype to mitigate this issue.

Fix

Special Elements Injection

Prototype Pollution

Weakness Enumeration

CWE-74

CWE-1321

Related Identifiers

CVE-2021-43852

GHSA-JX5Q-G37M-H5HJ

Affected Products

Oroplatform

References · 7

• https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9 · Patch
• https://osv.dev/vulnerability/GHSA-jx5q-g37m-h5hj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43852 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43852 · Vendor Advisory
• https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hj · Note
• https://github.com/oroinc/platform · Note
• https://t.me/cibsecurity/34957 · Telegram Post