CVE-2021-21304 Prototype Pollution in Dynamoose
Prototype pollution in Dynamoose allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21304?
CVE-2021-21304 is a high-severity vulnerability in dynamoose, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability.
Which versions are affected by CVE-2021-21304?
2 open source packages ship an affected version, including dynamoose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dynamoose npm | From 2.0.0 | 2.7.0 |
dynamoose npm | From 2.0.0 | 2.7.0 |
Products include Dynamoosejs Dynamoose.
How do I fix CVE-2021-21304?
Upgrade dynamoose to 2.7.0 or later.
Is CVE-2021-21304 being exploited?
There is no known exploitation of CVE-2021-21304 in the wild and no public exploit code.
Sources
Also known as GHSA-rrqm-p222-8ph2.