CVE-2024-32866

Executive Summary

CVE-2024-32866 is a critical prototype pollution vulnerability in Conform, a type-safe form validation library for JavaScript/TypeScript. The flaw exists in versions prior to 1.1.1, where the parsing of nested objects using dot notation (object.property) is improperly implemented. An attacker can craft a malicious input to parseWith... functions, polluting the global Object.prototype and potentially leading to remote code execution, data tampering, or denial of service. The vulnerability is particularly dangerous for applications using Conform for server-side validation of form data or URL parameters. The CVSS score is 8.6 (High), and no public exploit code or proof-of-concept is currently available. The vendor has released a patch in version 1.1.1.

Supply Chain & Package Security

This vulnerability affects the Conform npm package. Organizations using Conform in their Node.js applications must verify their dependency tree and update to version 1.1.1 or later. The package is widely used in form validation scenarios, making this a supply chain risk. Ensure that no transitive dependencies are pinned to vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation (no authentication or user interaction required) and the severe impact on confidentiality, integrity, and availability. Prototype pollution can lead to arbitrary code execution or data manipulation.

Deep Dive & Mechanics

The vulnerability resides in the parseWith... functions (e.g., parseWithFormData, parseWithURLParams) in Conform. These functions parse nested object keys using dot notation (e.g., user.name). Due to improper input validation, an attacker can inject keys like __proto__.polluted or constructor.prototype.polluted to modify the global Object.prototype. Once polluted, all objects in the application inherit the malicious property, potentially altering application behavior.

Technical Flow:

1. An attacker sends a crafted request with a key like __proto__.isAdmin and a value of true.
2. The parseWith... function splits the key by dots and recursively assigns the value to the nested object.
3. Without proper sanitization, the assignment reaches Object.prototype, polluting it.
4. Subsequent object creations or property lookups may return the attacker-controlled value, leading to privilege escalation or code execution.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.1.1):

function parseNestedKey(obj, key, value) {
  const keys = key.split('.');
  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    if (!current[keys[i]]) {
      current[keys[i]] = {};
    }
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

Patched Code (1.1.1):

function parseNestedKey(obj, key, value) {
  const keys = key.split('.');
  // Reject keys that target prototype properties
  if (keys.some(k => k === '__proto__' || k === 'constructor' || k === 'prototype')) {
    throw new Error('Invalid key');
  }
  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    if (!current[keys[i]]) {
      current[keys[i]] = {};
    }
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

The patch adds a check to reject keys containing __proto__, constructor, or prototype, preventing prototype pollution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Node.js application using Conform < 1.1.1 with server-side form validation.
• Network access to the application.

Exploitation Steps:

1. Identify an endpoint that uses parseWithFormData or parseWithURLParams.
2. Craft a request with a malicious key, e.g., __proto__.polluted=true.
3. Send the request. The server will pollute Object.prototype.
4. Verify pollution by checking if {}.polluted returns true.

Example Payload (HTTP POST):

POST /submit-form HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

__proto__.polluted=true&username=test

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests containing keys like __proto__, constructor, or prototype in form data or URL parameters.
• Use web application firewalls (WAF) to block such patterns.
• Implement input validation on the server side to reject dangerous keys.

Hunting:

• Search logs for __proto__ or constructor.prototype in request bodies.
• Check for unexpected properties on global objects in application logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing __proto__, constructor, or prototype in form data or URL parameters.
• Application: Presence of unexpected properties on Object.prototype (e.g., {}.polluted returns true).
• Logs: Error messages related to prototype pollution or unexpected object behavior.

Detection Engineering

YARA Rule

rule CVE_2024_32866_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts targeting Conform library"
    author = "Valters IT"
    date = "2025-04-10"
    cve = "CVE-2024-32866"
  strings:
    $proto1 = "__proto__"
    $proto2 = "constructor.prototype"
    $proto3 = "prototype."
  condition:
    any of ($proto*)
}

Sigma Rule

title: CVE-2024-32866 Prototype Pollution Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with prototype pollution payloads targeting Conform
author: Valters IT
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '__proto__'
      - 'constructor.prototype'
      - 'prototype.'
  condition: selection
falsepositives:
  - Legitimate use of these strings in non-form contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32866 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Conform to version 1.1.1 or later.
2. If immediate upgrade is not possible, implement a WAF rule to block requests containing __proto__, constructor, or prototype in form data or URL parameters.
3. Review and sanitize all user input before passing to parseWith... functions.

Long-Term Measures:

• Adopt a secure coding policy that includes input validation for nested keys.
• Use static analysis tools to detect prototype pollution vulnerabilities.
• Regularly update dependencies and monitor for security advisories.

Workaround:

• If upgrading is delayed, override the parseWith... functions to include the patch logic manually.

Valters IT
Securing Digital Frontiers