CVE-2025-27597

Executive Summary

CVE-2025-27597 is a Prototype Pollution vulnerability discovered in the @intlify/message-resolver and @intlify/vue-i18n-core packages, which are core components of the Vue I18n internationalization plugin for Vue.js. The flaw resides in the handleFlatJson function, which improperly processes user-supplied JSON input, allowing an attacker to pollute the global Object.prototype. This can lead to Denial of Service (DoS) as a minimum impact, but more critically, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it can enable Remote Code Execution (RCE) within the application's context.

The vulnerability affects all versions prior to 10.0.0 for both packages. The CVSS score is 0.0 in the NVD data, but based on the technical impact and attack vector, a more realistic score is 9.8 (Critical). No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability is particularly dangerous because it resides in widely used npm packages (@intlify/message-resolver and @intlify/vue-i18n-core). Applications that depend on these packages are at risk. The attack vector is through the handleFlatJson function, which is likely called when processing locale messages or configuration data. An attacker can supply a malicious JSON payload containing __proto__ or constructor.prototype keys to pollute the global prototype chain.

Mitigation in the supply chain:

• Immediately update to version >=10.0.0 of both packages.
• Audit your package-lock.json or yarn.lock to ensure no transitive dependencies are still vulnerable.
• Use tools like npm audit or snyk to detect vulnerable versions.

CVSS Breakdown & Threat Level

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the potential for RCE makes it a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic Prototype Pollution (CWE-1321) in the handleFlatJson function. This function is designed to flatten nested JSON objects into a single-level structure, likely for efficient message lookup. However, it does not sanitize keys that can modify the prototype chain.

How it works:

1. The handleFlatJson function recursively iterates over the keys of a JSON object.
2. If a key is __proto__, constructor.prototype, or prototype, the function assigns the value directly to Object.prototype.
3. This pollutes the global prototype, meaning all objects in the application will inherit the new property.
4. If the polluted property is a string that is later used in a dangerous sink (e.g., eval, exec, require), an attacker can achieve RCE.

Example of a malicious payload:

{
  "__proto__": {
    "shell": "node -e 'require(\"child_process\").execSync(\"id\")'"
  }
}

If the application later accesses obj.shell (where obj is any object), it will execute the attacker's command.

Vulnerable vs. Patched Code

Vulnerable code (simplified):

function handleFlatJson(obj, prefix = '') {
  const result = {};
  for (const key in obj) {
    const newKey = prefix ? `${prefix}.${key}` : key;
    if (typeof obj[key] === 'object' && obj[key] !== null) {
      Object.assign(result, handleFlatJson(obj[key], newKey));
    } else {
      result[newKey] = obj[key];
    }
  }
  return result;
}

This code does not check for __proto__ or constructor.prototype keys.

Patched code (>=10.0.0):

function handleFlatJson(obj, prefix = '') {
  const result = {};
  for (const key in obj) {
    // Skip prototype pollution keys
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      continue;
    }
    const newKey = prefix ? `${prefix}.${key}` : key;
    if (typeof obj[key] === 'object' && obj[key] !== null) {
      Object.assign(result, handleFlatJson(obj[key], newKey));
    } else {
      result[newKey] = obj[key];
    }
  }
  return result;
}

The fix adds a check to skip keys that could pollute the prototype.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target application using @intlify/message-resolver or @intlify/vue-i18n-core version <10.0.0.
• The application must accept user-controlled JSON input that is processed by handleFlatJson.

Exploitation Steps:

1. Identify an endpoint that accepts JSON data (e.g., locale configuration, message files).
2. Craft a payload that pollutes Object.prototype with a property that will be used in a dangerous sink.
3. Send the payload.

Example payload for DoS:

{
  "__proto__": {
    "toString": "function() { throw new Error('Polluted'); }"
  }
}

Example payload for RCE (if the app uses eval or exec with a polluted property):

{
  "__proto__": {
    "command": "id"
  }
}

Then, if the application does something like eval(obj.command), the attacker's command will execute.

Lab Setup:

• Use a local Node.js environment with a vulnerable version of the package.
• Create a simple Express server that accepts JSON and calls handleFlatJson.
• Test the payloads.

Blue Team (Defender)

Detection:

• Monitor for JSON payloads containing __proto__, constructor, or prototype keys.
• Use the detection rules below (YARA, Sigma, Suricata).
• Check for unexpected properties on objects (e.g., Object.prototype.shell).

Hunting:

• Search logs for JSON payloads with __proto__ or constructor.prototype.
• Use Node.js --inspect to check for prototype pollution in real-time.

Lab Setup:

• Deploy a honeypot with a vulnerable version of the package.
• Log all incoming JSON payloads and alert on suspicious keys.

Indicators of Compromise (IOCs)

• Network IOCs:

  • JSON payloads containing "__proto__", "constructor.prototype", or "prototype" keys.
  • Unusual HTTP requests to endpoints that process locale or message data.

• File IOCs:

  • Modified node_modules/@intlify/message-resolver or node_modules/@intlify/vue-i18n-core files (if attacker modified source).
  • Unexpected files in the application directory (e.g., reverse shell scripts).

• Process IOCs:

  • Node.js processes spawning unexpected child processes (e.g., exec, spawn).
  • Unusual network connections from the Node.js process.

• Log IOCs:

  • Errors related to Object.prototype modifications.
  • Stack traces showing handleFlatJson with __proto__ keys.

Detection Engineering

YARA Rule

rule CVE_2025_27597_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts in JSON payloads targeting @intlify/message-resolver"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-27597"
  strings:
    $proto1 = "__proto__"
    $proto2 = "constructor.prototype"
    $proto3 = "\"prototype\""
  condition:
    any of ($proto*)
}

Sigma Rule

title: CVE-2025-27597 Prototype Pollution Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects JSON payloads containing prototype pollution keys targeting @intlify/message-resolver
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.request.body|contains:
      - '__proto__'
      - 'constructor.prototype'
      - '"prototype"'
  condition: selection
falsepositives:
  - Legitimate use of '__proto__' in non-vulnerable contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27597 Prototype Pollution Attempt"; flow:to_server; content:"__proto__"; http_client_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-27597 Prototype Pollution Attempt"; flow:to_server; content:"constructor.prototype"; http_client_body; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update packages: Upgrade @intlify/message-resolver and @intlify/vue-i18n-core to version >=10.0.0.

   npm install @intlify/message-resolver@^10.0.0 @intlify/vue-i18n-core@^10.0.0
   

2. Validate input: Implement strict JSON schema validation to reject keys like __proto__, constructor, and prototype.
3. Use Object.freeze: Freeze Object.prototype in production to prevent pollution.

   Object.freeze(Object.prototype);
   

Long-term Mitigations:

• Code review: Ensure all JSON parsing functions sanitize keys.
• Use safe libraries: Consider using libraries like lodash with _.set that have built-in protection.
• Monitor dependencies: Use tools like npm audit, snyk, or Dependabot to track vulnerable packages.

Workarounds (if patching is not immediately possible):

• Implement a middleware that strips __proto__ and constructor.prototype from incoming JSON.
• Use a proxy (e.g., Nginx) to block requests containing these keys.

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact security@valters-it.com.