CVE-2021-41097 Prototype pollution in aurelia-path
Prototype pollution in aurelia-path allows attackers to modify Object prototypes via crafted URLs, potentially leading to code execution or privilege escalation in Aurelia applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41097?
CVE-2021-41097 is a critical vulnerability in aurelia path, published on 27 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.
Weakness: CWE-1321
Which versions are affected by CVE-2021-41097?
2 open source packages ship an affected version, including aurelia-path. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aurelia-path npm | All versions | 1.1.7 |
aurelia-path npm | All versions | 1.1.7 |
Products include Bluespire Aurelia-Path.
How do I fix CVE-2021-41097?
Upgrade aurelia-path to 1.1.7 or later.
Is CVE-2021-41097 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-41097 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-3c9c-2p65-qvwv.