2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-14020

CVE-2024-14020: carboneio carbone Formatter input.js prototype pollution

A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.5.6 will fix this issue. This patch is called 04f9feb24bfca23567706392f9ad2c53bbe4134e. You should upgrade the affected component. A successful exploitation can "only occur if the parent NodeJS application has the same security issue".

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-14020

CVE-2024-14020:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
carbone	npm	< 3.5.6	3.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the patch 04f9feb24bfca23567706392f9ad2c53bbe4134e reveals a prototype pollution vulnerability in the carbone library. The core of the vulnerability is in lib/input.js, where the formatters object was initialized as a standard object ({}), making it susceptible to prototype pollution. The added test case in test/test.carbone.js clearly demonstrates that the exploit is triggered via the carbone.renderXML function. This function is responsible for rendering templates and, in the process, looks up formatters from the vulnerable formatters object. If an attacker pollutes Object.prototype, the renderXML function will inadvertently access and execute the malicious code when resolving a formatter. Therefore, renderXML is the primary function that would appear in a runtime profile during the exploitation of this vulnerability. The fix involves creating the formatters object with Object.create(null), which severs the prototype chain and prevents the pollution from affecting the formatter resolution process.

Vulnerable functions

renderXML

lib/input.js

The vulnerability lies in the way formatters are handled during the rendering process. The `formatters` object was created using `{}`, making it inherit from `Object.prototype`. An attacker could pollute `Object.prototype` to add a malicious property. When `renderXML` is called to process a template, it looks up formatters in this object. The lookup would resolve to the malicious property on the prototype, leading to its execution and resulting in code injection. The patch mitigates this by creating the `formatters` object with `Object.create(null)`, which removes the prototype chain and prevents the polluted properties from being accessed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.