GHSA-82jv-9wjw-pqh6: Derby Prototype Pollution Vulnerability

Q: What is GHSA-82jv-9wjw-pqh6?

GHSA-82jv-9wjw-pqh6 is a security vulnerability in Derby involving Prototype pollution in emit function under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Q: Which Derby versions are affected?

Affected versions include releases prior to 2.3.2, 3.0.2, 4.0.0-beta.11 across affected packages: derby.

Q: What version fixes GHSA-82jv-9wjw-pqh6?

Upgrading to 2.3.2, 3.0.2, 4.0.0-beta.11 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is derby affected?

Yes, derby is affected in releases prior to 2.3.2, 3.0.2, 4.0.0-beta.11. Upgrade your dependency to 2.3.2, 3.0.2, 4.0.0-beta.11 or later.

Q: What CWE is associated with GHSA-82jv-9wjw-pqh6?

GHSA-82jv-9wjw-pqh6 is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.).

Q: How can I check npm dependencies for GHSA-82jv-9wjw-pqh6?

Run the dependency tree command: 'npm ls derby'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

LOW

CWE-1321

Published 2024-04-17

Advisory Summary

GHSA-82jv-9wjw-pqh6 is a LOW prototype pollution vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting Derby libraries in the npm ecosystem. The issue involves prototype pollution in emit function. Remediation is available by upgrading affected packages to version 2.3.2, 3.0.2, 4.0.0-beta.11.

GHSA-82jv-9wjw-pqh6 at a Glance

CVE Identifier N/A

GHSA Identifier GHSA-82jv-9wjw-pqh6

Severity LOW

CVSS v3.1 Base Score N/A

CWE Classification CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected Product Derby

Package Ecosystem npm

Published Date 2024-04-17

Last Updated 2024-04-17

How to Fix GHSA-82jv-9wjw-pqh6

To remediate this vulnerability, upgrade all affected Derby dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

derby fixed: 2.3.2

npm install derby@2.3.2

derby fixed: 3.0.2

npm install derby@3.0.2

derby fixed: 4.0.0-beta.11

npm install derby@4.0.0-beta.11

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

npm ls derby

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-82jv-9wjw-pqh6, inspect your project dependencies using npm:

npm ls derby

Analyze the terminal output to locate any version of Derby in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.3.2), your application is affected.

Note: The npm ls derby command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In Derby, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key. Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications. ### Details ``` emit(context: Context, target: T) { const node = traverseAndCreate(context.controller, this.segments); node[this.lastSegment] = target; this.addListeners(target, node, this.lastSegment); } ``` The emit() function in src/templates/templates.ts is called without sanitizing the variable `this.lastSegment `. The variable `this.lastSegment ` can be set to `__proto__`, and this will pollute the prototype of Javascipt Object (`node['__proto__'] = target`). ### PoC To reproduce this vulnerability, you can adjust the test case `ignores DOM mutations in components\' create()` in `test/dom/ComponentHarness.mocha.js`. ``` it('ignores DOM mutations in components\' create()', function() { function Box() {} Box.view = { is: 'box', - source: '<index:><div class="box" as="boxElement"></div>' + source: '<index:><div class="box" as="__proto__"></div>' }; Box.prototype.create = function() { this.boxElement.className = 'box-changed-in-create'; }; var harness = runner.createHarness('<view is="box" />', Box); expect(harness).to.render('<div class="box"></div>'); }); ``` When `as` attribute is controlled by attackers, the variable in `this.lastSegment` will exactly take value` __proto__` and prototype pollution happens. ### Patch Add a check on `this.lastSegment` can prevent this attack. ``` emit(context: Context, target: T) { const node = traverseAndCreate(context.controller, this.segments); + if (this.lastSegment.includes('__proto__') || this.lastSegment.includes('prototype')) { + throw new Error('Unsafe code detected'); + } node[this.lastSegment] = target; this.addListeners(target, node, this.lastSegment); } ```

GHSA-82jv-9wjw-pqh6 Affected Derby Versions

3 component(s)

Fixed Versions:

2.3.23.0.24.0.0-beta.11

Product / Package	Ecosystem	Affected Versions	Fixed Version
derby npm/derby	npm	< 2.3.2	2.3.2
derby npm/derby	npm	≥ 3.0.0 < 3.0.2	3.0.2
derby npm/derby	npm	≥ 4.0.0-beta1 < 4.0.0-beta.11	4.0.0-beta.11

References

GitHub Advisory / Wiki ADVISORY

https://github.com/derbyjs/derby/security/advisories/GHSA-82jv-9wjw-pqh6

Security Fix Commit FIX COMMIT

https://github.com/derbyjs/derby/commit/24524e96f36976883c7c619811320428536bd4d0

Security Fix Commit FIX COMMIT

https://github.com/derbyjs/derby/commit/465a0c2f6a77361eda4a09b77a8c94ba6a9da440

Derby Source Repository REPOSITORY

https://github.com/derbyjs/derby

Frequently Asked Questions

What is GHSA-82jv-9wjw-pqh6?

GHSA-82jv-9wjw-pqh6 is a security vulnerability in Derby involving Prototype pollution in emit function under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Which Derby versions are affected?

Affected versions include releases prior to 2.3.2, 3.0.2, 4.0.0-beta.11 across affected packages: derby.

What version fixes GHSA-82jv-9wjw-pqh6?

Upgrading to 2.3.2, 3.0.2, 4.0.0-beta.11 (or the latest patched release for your respective branch) resolves the vulnerability.

Is derby affected?

Yes, derby is affected in releases prior to 2.3.2, 3.0.2, 4.0.0-beta.11. Upgrade your dependency to 2.3.2, 3.0.2, 4.0.0-beta.11 or later.

What CWE is associated with GHSA-82jv-9wjw-pqh6?

GHSA-82jv-9wjw-pqh6 is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.).

How can I check npm dependencies for GHSA-82jv-9wjw-pqh6?

Run the dependency tree command: 'npm ls derby'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-82jv-9wjw-pqh6",
  "modified" : "2024-04-17T22:26:37Z",
  "published" : "2024-04-17T22:26:37Z",
  "aliases" : [ ],
  "summary" : "Prototype pollution in emit function",
  "details" : "### Summary\nA prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.\n\nAttribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.\n\n### Details\n```\nemit(context: Context, target: T) {\n  const node = traverseAndCreate(context.controller, this.segments);\n    node[this.lastSegment] = target;\n    this.addListeners(target, node, this.lastSegment);\n}\n```\nThe emit() function in src/templates/templates.ts is called without sanitizing the variable `this.lastSegment `. The variable `this.lastSegment ` can be set to `__proto__`, and this will pollute the prototype of Javascipt Object (`node['__proto__'] = target`).\n\n### PoC\nTo reproduce this vulnerability, you can adjust the test case `ignores DOM mutations in components\\' create()` in `test/dom/ComponentHarness.mocha.js`.\n\n```\nit('ignores DOM mutations in components\\' create()', function() {\n      function Box() {}\n      Box.view = {\n        is: 'box',\n-        source: '<index:><div class=\"box\" as=\"boxElement\"></div>'\n+        source: '<index:><div class=\"box\" as=\"__proto__\"></div>'\n      };\n      Box.prototype.create = function() {\n        this.boxElement.className = 'box-changed-in-create';\n      };\n      var harness = runner.createHarness('<view is=\"box\" />', Box);\n      expect(harness).to.render('<div class=\"box\"></div>');\n});\n```\nWhen `as` attribute is controlled by attackers, the variable in `this.lastSegment` will exactly take value` __proto__` and prototype pollution happens.\n\n### Patch\nAdd a check on `this.lastSegment` can prevent this attack.\n```\nemit(context: Context, target: T) {\n  const node = traverseAndCreate(context.controller, this.segments);\n+  if (this.lastSegment.includes('__proto__') || this.lastSegment.includes('prototype')) {\n+    throw new Error('Unsafe code detected');\n+  }\n    node[this.lastSegment] = target;\n    this.addListeners(target, node, this.lastSegment);\n}\n```\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "derby"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.3.1"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "derby"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.0.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.0.1"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "derby"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-beta1"
      }, {
        "fixed" : "4.0.0-beta.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.0.0-beta.10"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/derbyjs/derby/security/advisories/GHSA-82jv-9wjw-pqh6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/derbyjs/derby/commit/24524e96f36976883c7c619811320428536bd4d0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/derbyjs/derby/commit/465a0c2f6a77361eda4a09b77a8c94ba6a9da440"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/derbyjs/derby"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1321" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-04-17T22:26:37Z",
    "nvd_published_at" : null
  }
}

Advisory Metadata

Source ID: GHSA-82jv-9wjw-pqh6
Schema Version: 1.4.0
Published: 2024-04-17 22:26
Last Modified: 2024-04-17 22:26
Database Record File: advisories/github-reviewed/2024/04/GHSA-82jv-9wjw-pqh6/GHSA-82jv-9wjw-pqh6.json