Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-36665

CVE-2023-36665: protobufjs Prototype Pollution vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-36665
GHSA ID
GHSA-h755-8qp9-cq85
EPSS Score
0.81312%
CWE
CWE-1321
Published
7/5/2023
Updated
6/28/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
protobufjsnpm>= 6.10.0, < 6.11.46.11.4
protobufjsnpm>= 7.0.0, < 7.2.57.2.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from four primary vectors: 1) util.setProperty lacked prototype protection checks (fixed in e66379f), 2) setParsedOption accepts untrusted paths, 3) parse() handles raw protobuf messages with embedded options, and 4) load/loadSync process schema definitions. All were explicitly listed in vulnerability descriptions and patched versions add prototype access checks. The commit diff shows prototype protection added to util.setProperty, and advisory examples demonstrate exploitation through these entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

proto*u*.js (*k* proto*u*js) *.**.* until *.**.* *n* *.*.* until *.*.* *llows Prototyp* Pollution, * *i***r*nt vuln*r**ility t**n *V*-****-*****. * us*r-*ontroll** proto*u* m*ss*** **n ** us** *y *n *tt**k*r to pollut* t** prototyp* o* O*j**t.prototy

Reasoning

T** vuln*r**ility st*ms *rom *our prim*ry v**tors: *) `util.s*tProp*rty` l**k** prototyp* prot**tion ****ks (*ix** in *******), *) `s*tP*rs**Option` ****pts untrust** p*t*s, *) `p*rs*()` **n*l*s r*w proto*u* m*ss***s wit* *m****** options, *n* *) `lo