Proof-of-concept exploit code has been printed for a important distant code execution flaw in protobuf.js, a broadly used JavaScript implementation of Google’s Protocol Buffers.
The software is very standard within the Node Bundle Supervisor (npm) registry, with a mean of almost 50 million weekly downloads. It’s used for inter-service communication, in real-time purposes, and for environment friendly storage of structured knowledge in databases and cloud environments.
In a report on Friday, software safety firm Endor Labs says that the distant code execution vulnerability (RCE) in protobuf.js is attributable to unsafe dynamic code technology.
The safety problem has not obtained an official CVE quantity and is at present being tracked as GHSA-xq3m-2v4x-88gg, the identifier assigned by GitHub.
Endor Labs explains that the library builds JavaScript capabilities from protobuf schemas by concatenating strings and executing them by way of the Operate() constructor, however it fails to validate schema-derived identifiers, akin to message names.
This lets an attacker provide a malicious schema that injects arbitrary code into the generated operate, which is then executed when the applying processes a message utilizing that schema.
This opens the trail to RCE on servers or purposes that load attacker-influenced schemas, granting entry to surroundings variables, credentials, databases, and inside methods, and even permitting lateral motion throughout the infrastructure.
The assault might additionally have an effect on developer machines if these load and decode untrusted schemas domestically.
The flaw impacts protobuf.js variations 8.0.0/7.5.4 and decrease. Endor Labs recommends upgrading to eight.0.1 and seven.5.5, which handle the problem.
The patch sanitizes kind names by stripping non-alphanumeric characters, stopping the attacker from closing the artificial operate. Nevertheless, Endor feedback {that a} longer-term repair could be to cease round-tripping attacker-reachable identifiers by way of Operate in any respect.
Endor Labs is warning that “exploitation is easy,” and that the minimal proof-of-concept (PoC) included within the safety advisory displays this. Nevertheless, no energetic exploitation within the wild has been noticed up to now.
The vulnerability was reported by Endor Labs researcher and safety bug bounty hunter Cristian Staicu on March 2, and the protobuf.js maintainers launched a patch on GitHub on March 11. Fixes to the npm packages had been made obtainable on April 4 for the 8.x department and on April 15 for the 7.x department.
Aside from upgrading to patched variations, Endor Labs additionally recommends that system directors audit transitive dependencies, deal with schema-loading as untrusted enter, and like precompiled/static schemas in manufacturing.
AI chained 4 zero-days into one exploit that bypassed each renderer and OS sandboxes. A wave of recent exploits is coming.
On the Autonomous Validation Summit (Might 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls maintain, and closes the remediation loop.
