CVE-2024-52810

Executive Summary

CVE-2024-52810 is a Prototype Pollution vulnerability discovered in the @intlify/shared library, a core component of the intlify project used for internationalization in JavaScript applications. The vulnerability resides in the lib.deepCopy function, which fails to sanitize user-supplied input against prototype pollution attacks. An attacker can craft a payload that sets properties on Object.prototype, leading to global property pollution. The minimum impact is Denial of Service (DoS), but the vulnerability can escalate to arbitrary code execution if polluted properties propagate to sensitive Node.js APIs such as exec or eval. The issue has been patched in versions 9.14.2 and 10.0.5. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is significant due to the library's widespread use in internationalization workflows.

Supply Chain & Package Security

@intlify/shared is an npm package. This vulnerability poses a supply chain risk because applications that depend on this library may inherit the flaw. Developers must ensure their package.json or lock files are updated to use patched versions. Automated dependency scanning tools (e.g., npm audit, Snyk, Dependabot) should be configured to flag versions below 9.14.2 or 10.0.5. Additionally, runtime monitoring for prototype pollution attempts is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while the direct impact is DoS, the potential for escalation to RCE makes it critical.

Deep Dive & Mechanics

The vulnerability is a classic Prototype Pollution (CWE-1321) in the lib.deepCopy function of @intlify/shared. The function is designed to deep-copy objects, but it does not properly check for __proto__, constructor.prototype, or other prototype-altering keys. When an attacker supplies an object like {"__proto__": {"polluted": true}}, the function recursively copies properties without filtering, thereby polluting Object.prototype.

Attack Flow:

1. The attacker sends a crafted JSON payload to an endpoint that uses @intlify/shared's deepCopy function.
2. The deepCopy function iterates over the payload's keys and assigns them to a new object.
3. If the payload contains __proto__ or constructor.prototype, the assignment modifies the global Object.prototype.
4. Once polluted, all objects in the application inherit the new property, potentially causing unexpected behavior or security bypasses.
5. If the polluted property is later used in a sensitive operation (e.g., eval(pollutedProperty)), the attacker can achieve RCE.

Example Payload:

{
  "__proto__": {
    "polluted": "true"
  }
}

Vulnerable vs. Patched Code

Vulnerable Code (version < 9.14.2 or < 10.0.5):

function deepCopy(src) {
  const dest = Array.isArray(src) ? [] : {};
  for (const key in src) {
    if (src.hasOwnProperty(key)) {
      dest[key] = typeof src[key] === 'object' ? deepCopy(src[key]) : src[key];
    }
  }
  return dest;
}

Patched Code (version >= 9.14.2 or >= 10.0.5):

function deepCopy(src) {
  const dest = Array.isArray(src) ? [] : {};
  for (const key in src) {
    if (src.hasOwnProperty(key) && key !== '__proto__' && key !== 'constructor') {
      dest[key] = typeof src[key] === 'object' ? deepCopy(src[key]) : src[key];
    }
  }
  return dest;
}

The patch adds explicit checks to skip __proto__ and constructor keys, preventing prototype pollution.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Create a Node.js application that uses @intlify/shared version 10.0.4.
2. Expose an endpoint that accepts JSON input and passes it to deepCopy.
3. Send the following payload to trigger prototype pollution:

curl -X POST http://target:3000/api/copy \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"polluted": "true"}}'

Verification: After sending the payload, check if Object.prototype.polluted exists:

console.log({}.polluted); // Should output "true"

Escalation to RCE (if applicable): If the application later uses the polluted property in a dangerous function, e.g.:

const cmd = someObject.polluted;
require('child_process').exec(cmd);

The attacker can set polluted to a malicious command.

Blue Team (Detection & Defense)

Detection:

• Monitor for requests containing __proto__, constructor.prototype, or similar keys in JSON payloads.
• Use runtime application self-protection (RASP) tools to detect prototype pollution attempts.
• Enable logging for all Object.prototype modifications.

Defense:

• Immediately upgrade to patched versions (9.14.2 or 10.0.5).
• Implement input validation to strip dangerous keys before processing.
• Use Object.freeze(Object.prototype) to prevent any modifications.
• Deploy Web Application Firewall (WAF) rules to block payloads with __proto__.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing JSON with __proto__ or constructor.prototype keys.
• Application Logs: Entries showing unexpected properties on base objects (e.g., polluted).
• File System: Modified node_modules/@intlify/shared files (if tampered locally).
• Process: Node.js processes with abnormal memory usage or child process spawns.

Detection Engineering

YARA Rule

rule CVE_2024_52810_Prototype_Pollution {
    meta:
        description = "Detects prototype pollution attempts in @intlify/shared"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52810"
    strings:
        $proto1 = "__proto__"
        $proto2 = "constructor.prototype"
        $deepCopy = "deepCopy"
    condition:
        any of ($proto*) and $deepCopy
}

Sigma Rule

title: CVE-2024-52810 Prototype Pollution Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with prototype pollution payloads targeting @intlify/shared
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.request.body|contains:
            - '__proto__'
            - 'constructor.prototype'
    condition: selection
falsepositives:
    - Legitimate use of __proto__ in rare cases (e.g., polyfills)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52810 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade @intlify/shared to version 9.14.2 or 10.0.5.
2. Run npm audit to identify all affected dependencies.
3. If immediate upgrade is not possible, implement a middleware that strips __proto__ and constructor keys from all incoming JSON payloads.

Long-term Measures:

• Integrate dependency scanning into CI/CD pipeline.
• Use Object.freeze(Object.prototype) in production code.
• Conduct regular security reviews of third-party libraries.
• Monitor for new CVEs related to prototype pollution.

Workarounds:

• No official workaround exists. The only safe mitigation is upgrading.

Valters IT