CVE-2021-21304: Prototype Pollution in Dynamoose
Summary
CVE-2021-21304: Prototype Pollution in Dynamoose. Affects dynamoose versions >= 2.0.0, < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dynamoose is an npm package that provides an easy-to-use modeling tool for Amazon DynamoDB. It simplifies the interaction with DynamoDB by abstracting away the low-level details. Dynamoose versions 2.0.0-2.6.0 are affected by a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts. This method is extensively used throughout the codebase for various operations. The vulnerability does not impact v1.x.x and also affects v2.x.x beta/alpha versions.
Vulnerability Detail
The prototype pollution vulnerability in Dynamoose can lead to various security issues. By manipulating the prototype of an object, an attacker can inject or modify properties and methods, potentially leading to remote code execution, denial of service, or information disclosure. The vulnerable method set.ts is responsible for setting properties in objects, making it a critical point of exploitation.
How To Fix
Minimum fixed version
2.7.0
This is the first release that contains the fix.
npm install dynamoose@2.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.
Conclusion
The prototype pollution vulnerability in Dynamoose versions 2.0.0-2.6.0 and v2.x.x beta/alpha versions can have severe security implications. It is crucial to upgrade to version 2.7.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for dynamoose →
FAQ
The vulnerability can be exploited to manipulate object prototypes, potentially leading to remote code execution, denial of service, or information disclosure.
No, the vulnerability affects Dynamoose versions 2.0.0-2.6.0 and v2.x.x beta/alpha versions. It does not impact v1.x.x.
No, there is no evidence of this vulnerability being exploited at the moment.
For more information, you can contact the developer at https://charlie.fish/contact or refer to the project's Security Policy at https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md.
The vulnerability has a severity rating of HIGH with a CVSS score of 7.2.
