CVE-2021-23408: Prototype Pollution in GraphHopper
Summary
CVE-2021-23408: Prototype Pollution in GraphHopper. Affects com.graphhopper:graphhopper-web-bundle versions < 3.2. Fixed in 3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphHopper is a package in the Maven ecosystem that provides routing and navigation capabilities. The com.graphhopper:graphhopper-web-bundle package, specifically versions before 3.2, from 4.0-pre1, and before 4.0, is affected by a vulnerability. This vulnerability allows the URL parser to be manipulated, leading to the addition or modification of properties in Object.prototype using constructor or __proto__ payloads.
Vulnerability Detail
The vulnerability in GraphHopper's com.graphhopper:graphhopper-web-bundle package arises from a lack of proper input validation in the URL parser. By exploiting this, an attacker can inject malicious payloads that manipulate the Object.prototype and potentially impact the behavior of the application. This could lead to various security issues, such as remote code execution or privilege escalation. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.4.
How To Fix
Minimum fixed version
3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk.
Conclusion
The vulnerability in GraphHopper's com.graphhopper:graphhopper-web-bundle package allows for prototype pollution, potentially leading to security risks such as remote code execution or privilege escalation. It is crucial to update to version 3.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.graphhopper:graphhopper-web-bundle →
FAQ
This vulnerability allows an attacker to manipulate the Object.prototype and potentially execute arbitrary code or escalate privileges within the affected application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading to version 3.2 or later of the com.graphhopper:graphhopper-web-bundle package fixes this vulnerability.
There are no known public exploits available for this vulnerability at the time of this report.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-qhxh-9hhx-6p7v/GHSA-qhxh-9hhx-6p7v.json
