Описание
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This prototype pollution vulnerability occurs when Object.prototype is polluted, allowing attacker-controlled properties to be resolved as valid protobuf type information. This can lead to attacker-controlled strings being emitted into generated JavaScript code, potentially resulting in arbitrary code execution.
Отчет
This Important flaw in protobufjs, a JavaScript library, potentially enables arbitrary code execution when a separate prototype pollution vulnerability is present in an application. Exploitation requires an attacker to first pollute Object.prototype and then trigger protobufjs functionality that generates encode or decode code for affected types. Red Hat products utilizing protobufjs may be impacted if they are vulnerable to prototype pollution.
Меры по смягчению последствий
Mitigation involves preventing prototype pollution within applications that utilize protobufjs. Administrators should ensure that untrusted input cannot pollute Object.prototype in the application or its dependencies. Additionally, isolating schema and message processing from untrusted application states can prevent attacker-controlled properties from being resolved as valid protobuf type information.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-pf5-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel8 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-ossmc-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/gateway-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Not affected | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Not affected | ||
| Red Hat Ceph Storage 9 | rhceph/alloy-rhel10 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
protobufjs compiles protobuf definitions into JavaScript (JS) function ...
protobuf.js: Code generation gadget after prototype pollution
Уязвимость функции JavaScript (JS) библиотеки для работы с протоколом Protocol Buffers (Protobuf) protobufjs, позволяющая нарушителю выполнить произвольный код
EPSS
8.1 High
CVSS3