CVE-2024-38985

Executive Summary

CVE-2024-38985 identifies a prototype pollution vulnerability in the janryWang products depath (v1.0.6) and cool-path (v1.1.2). The flaw resides in the set() method at setIn (lib/index.js:90), allowing an attacker to inject arbitrary properties into the global object prototype. This can lead to arbitrary code execution or Denial of Service (DoS). The vulnerability is publicly known but no official patch has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for applications using these libraries.

Supply Chain & Package Security

Both depath and cool-path are npm packages. Prototype pollution in these packages can propagate to any application that depends on them, potentially affecting the entire supply chain. Developers should audit their package-lock.json or yarn.lock for these packages and consider replacing them with safer alternatives until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (if code execution achieved)
• Integrity (I): High
• Availability (A): High

Threat Level: High. Prototype pollution can lead to full application compromise.

Deep Dive & Mechanics

Prototype pollution occurs when user-controlled input is used to set properties on an object without proper validation. In depath and cool-path, the set() method at setIn (lib/index.js:90) recursively traverses a path and assigns values. If the path contains __proto__, constructor.prototype, or similar, the attacker can pollute the global Object.prototype.

Vulnerable Code Snippet (lib/index.js:90):

function setIn(obj, path, value) {
  var keys = path.split('.');
  var current = obj;
  for (var i = 0; i < keys.length - 1; i++) {
    if (!current[keys[i]]) {
      current[keys[i]] = {};
    }
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

The lack of checks for __proto__ or constructor allows pollution.

Vulnerable vs. Patched Code

Vulnerable:

// depath v1.0.6 / cool-path v1.1.2
function setIn(obj, path, value) {
  var keys = path.split('.');
  var current = obj;
  for (var i = 0; i < keys.length - 1; i++) {
    if (!current[keys[i]]) {
      current[keys[i]] = {};
    }
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

Patched (hypothetical):

function setIn(obj, path, value) {
  var keys = path.split('.');
  var current = obj;
  for (var i = 0; i < keys.length - 1; i++) {
    if (keys[i] === '__proto__' || keys[i] === 'constructor' || keys[i] === 'prototype') {
      throw new Error('Prototype pollution attempt');
    }
    if (!current[keys[i]]) {
      current[keys[i]] = {};
    }
    current = current[keys[i]];
  }
  if (keys[keys.length - 1] === '__proto__' || keys[keys.length - 1] === 'constructor' || keys[keys.length - 1] === 'prototype') {
    throw new Error('Prototype pollution attempt');
  }
  current[keys[keys.length - 1]] = value;
}

Exploitation & Lab Setup

Red Team

Exploit PoC:

// Requires Node.js and the vulnerable package
const depath = require('depath'); // or cool-path
const obj = {};
depath.set(obj, '__proto__.polluted', 'true');
console.log({}.polluted); // Outputs: 'true'

Lab Setup:

1. Create a new Node.js project.
2. Install the vulnerable package: npm install depath@1.0.6
3. Run the PoC script.

Impact: After pollution, all objects inherit the polluted property. This can be used to bypass security checks, inject malicious defaults, or cause DoS by overriding critical properties.

Blue Team

Detection:

• Monitor for unexpected properties on global objects.
• Use runtime protection libraries like safe-obj or lodash.set with safe defaults.
• Implement input validation to reject paths containing __proto__, constructor, or prototype.

Mitigation:

• Remove or replace the vulnerable packages.
• Apply a patch if available (none currently).
• Use a Web Application Firewall (WAF) to block malicious payloads.

Indicators of Compromise (IOCs)

• File Hashes:
  • depath v1.0.6: SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
  • cool-path v1.1.2: SHA256 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a (example)
• Network Indicators: None specific.
• Log Patterns: Look for __proto__, constructor.prototype, or prototype in JSON payloads or URL parameters.

Detection Engineering

YARA Rule

rule prototype_pollution_depath {
  meta:
    description = "Detects prototype pollution attempts in depath/cool-path"
    author = "Valters IT"
    date = "2024-10-01"
    reference = "CVE-2024-38985"
  strings:
    $proto = "__proto__"
    $constructor = "constructor.prototype"
    $prototype = "prototype"
  condition:
    any of them
}

Sigma Rule

title: Prototype Pollution via depath/cool-path
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-38985
author: Valters IT
logsource:
  category: application
  product: nodejs
detection:
  selection:
    - "Payload": "*__proto__*"
    - "Payload": "*constructor.prototype*"
    - "Payload": "*prototype*"
  condition: selection
falsepositives:
  - Legitimate use of prototype in code (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38985 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Remove or replace depath and cool-path with safe alternatives (e.g., lodash.set with safe checks).
2. Short-term: Implement input validation to block __proto__, constructor, and prototype in object paths.
3. Long-term: Monitor for official patches from janrywang. If none, fork and patch the library.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules.
5. Training: Educate developers on prototype pollution risks.

Valters IT
Securing the digital frontier, one CVE at a time.