json-schema ist anfällig für Prototype Pollution

Prototype Pollution vulnerabilities arise when an attacker can inject properties into the global Object.prototype or the prototypes of other built-in JavaScript objects. In the context of json-schema, this could allow an attacker to modify the behavior of the schema validation process. A successful exploitation could lead to denial-of-service by corrupting the object prototype, or, in more severe cases, potentially enable arbitrary code execution if the modified prototype is used in sensitive operations. The impact is particularly concerning in Node.js environments where json-schema is frequently used for data validation and configuration management.

1. Reserviert2021-11-02
2. Veröffentlicht2021-11-19
3. Geändert2025-01-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2021-3918 is to upgrade the json-schema library to version 0.4.0 or later. If upgrading is not immediately feasible due to compatibility issues, consider implementing input validation and sanitization to prevent malicious data from reaching the json-schema library. While not a complete solution, restricting the input data to trusted sources can reduce the attack surface. Furthermore, consider using a Web Application Firewall (WAF) that can detect and block attempts to inject prototype pollution payloads. There are no specific Sigma or YARA rules readily available for this particular vulnerability, but generic prototype pollution detection rules may be applicable.

Zuletzt aktualisiert

0.4.0vor 55 Monaten