object-path में प्रोटोटाइप प्रदूषण

The core of this vulnerability lies in how object-path handles array-based path components. Specifically, the condition currentPath === 'proto' incorrectly returns false when currentPath is ['proto'] due to type differences. This bypass allows attackers to circumvent security checks designed to prevent access to sensitive properties. Successful exploitation could enable an attacker to read or modify arbitrary properties within the targeted JavaScript object, potentially leading to information disclosure or remote code execution depending on the application's context. The impact is amplified if the object-path package is used in a critical part of an application's data processing pipeline.

Applications that rely on the object-path Node.js package for data manipulation or configuration parsing are at risk. This includes projects using object-path as a dependency, especially those that process user-supplied data or handle sensitive configuration information. Projects that have previously attempted to mitigate CVE-2020-15256 may still be vulnerable if they have not upgraded to a patched version of object-path.

• nodejs: Use npm audit to identify vulnerable versions of object-path in your project dependencies.

npm audit object-path

• nodejs: Check the version of object-path installed in your Node.js projects using npm list or require('object-path').

npm list object-path

• generic web: Examine application logs for unusual object property access patterns, particularly those involving array-based path components.

1. 2021-09-01Disclosure

   disclosure

1. आरक्षित2021-01-08
2. प्रकाशित2021-09-01
3. संशोधित2025-01-14
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2021-23434 is to immediately upgrade the object-path package to version 0.11.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation to ensure that path components are not provided as arrays. While a WAF or proxy cannot directly address this vulnerability, they can be configured to monitor for suspicious patterns in requests that might indicate an attempted exploitation. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for unusual object property access patterns within your application's logs is recommended.