CVE-2021-41097
published 2021-09-27CVE-2021-41097: aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before…
PriorityP353high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EXPLOIT
EPSS
5.05%
91.2th percentile
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aurelia | path | < 1.1.7 | 1.1.7 |
| bluespire | aurelia-path | < 1.1.7 | 1.1.7 |
| bluespire | aurelia-path | >= 0 < 1.1.7 | 1.1.7 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Prototype pollution in aurelia-path
osv·2021-09-27
CVE-2021-41097 [CRITICAL] Prototype pollution in aurelia-path
Prototype pollution in aurelia-path
### Impact
The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`
### Patches
The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable.
### Workarounds
A partial work around is to free the Object prototype:
```ts
Object.freeze(Object.prototype)
```
GHSA
Prototype pollution in aurelia-path
ghsa·2021-09-27
CVE-2021-41097 [CRITICAL] CWE-1321 Prototype pollution in aurelia-path
Prototype pollution in aurelia-path
### Impact
The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`
### Patches
The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable.
### Workarounds
A partial work around is to free the Object prototype:
```ts
Object.freeze(Object.prototype)
```
No detection rules found.
Nuclei
Aurelia-Path < 1.1.7 - Prototype Pollution
nuclei·CVSS 7.5
CVE-2021-41097 [HIGH] Aurelia-Path < 1.1.7 - Prototype Pollution
Aurelia-Path < 1.1.7 - Prototype Pollution
Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs.
Template:
id: CVE-2021-41097
info:
name: Aurelia-Path < 1.1.7 - Prototype Pollution
author: 0x_Akoko
severity: high
description: |
Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs.
impact: |
Update to version 1.1.7 or later.
remediation: |
Aurelia-path parseQueryString function was found vulnerable to prototype pollution via crafted __proto__ URL parameters.
reference:
- https://githu
No writeups or analysis indexed.
https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1https://github.com/aurelia/path/issues/44https://github.com/aurelia/path/releases/tag/1.1.7https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwvhttps://www.npmjs.com/package/aurelia-pathhttps://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1https://github.com/aurelia/path/issues/44https://github.com/aurelia/path/releases/tag/1.1.7https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwvhttps://www.npmjs.com/package/aurelia-path
2021-09-27
Published