CVE-2024-21505 web3-utils Prototype Pollution vulnerability
Prototype pollution in web3-utils allows attackers to manipulate object prototypes via crafted input, potentially leading to code execution or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21505?
CVE-2024-21505 is a high-severity vulnerability in web3-utils, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
Weakness: CWE-1321
Which versions are affected by CVE-2024-21505?
2 open source packages ship an affected version, including web3-utils.
| Package | Affected | Fixed in |
|---|---|---|
web3-utils npm | From 4.0.1 | 4.2.1 |
web3-utils npm | From 4.0.1 | 4.2.1 |
How do I fix CVE-2024-21505?
Upgrade web3-utils to 4.2.1 or later.
Is CVE-2024-21505 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21505 exists.
Sources
Also known as GHSA-2g4c-8fpm-c46v.