PT-2024-18920 · Unknown · Web3-Utils

Tariq Hawis · Published 2024-03-24 · Updated 2024-08-01 · CVE-2024-21505

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions web3-utils versions prior to 4.2.1

Description The issue concerns Prototype Pollution via the utility functions format and mergeDeep due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.

Recommendations For versions prior to 4.2.1, upgrade to web3-utils version 4.2.1 to resolve the issue. As a temporary workaround, consider restricting the use of the mergeDeep() function until the upgrade is applied. Additionally, be cautious when using the format function with untrusted input to minimize the risk of exploitation.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-21505

GHSA-2G4C-8FPM-C46V

GHSA-87QP-7CW8-8Q9C

Affected Products

Web3-Utils

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-21505 · Security Note
• https://osv.dev/vulnerability/GHSA-2g4c-8fpm-c46v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21505 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87qp-7cw8-8q9c · Vendor Advisory
• https://github.com/web3/web3.js · Note
• https://github.com/web3/web3.js/security/advisories/GHSA-2g4c-8fpm-c46v · Note
• https://github.com/web3/web3.js/commit/8ed041c6635d807b3da8960ad49e125e3d1b0e80 · Note
• https://security.snyk.io/vuln/SNYK-JS-WEB3UTILS-6229337 · Note
• https://twitter.com/vuldb/status/1772144520026800166 · Twitter Post
• https://twitter.com/cracbot/status/1772709548177989871 · Twitter Post
• https://twitter.com/CVEnew/status/1772130353622536525 · Twitter Post
• https://t.me/cvenotify/88292 · Telegram Post