CVE-2020-36632: Flat_project Flat RCE Vulnerability

CVE-2020-36632 Overview

A critical prototype pollution vulnerability was discovered in the hughsk flat package up to version 5.0.0. This vulnerability affects the unflatten function within the index.js file, allowing attackers to manipulate JavaScript object prototypes through improperly controlled modification of object prototype attributes. The attack can be initiated remotely without authentication, potentially leading to denial of service, remote code execution, or property injection across all objects in the application.

Critical Impact

This prototype pollution vulnerability enables remote attackers to inject malicious properties into JavaScript object prototypes via the unflatten function, potentially compromising the entire application's object inheritance chain and enabling further exploitation vectors.

Affected Products

• flat_project flat versions up to 5.0.0
• Applications using the flat npm package for flattening/unflattening nested JavaScript objects
• Node.js applications with direct or transitive dependencies on vulnerable flat versions

Discovery Timeline

• 2022-12-25 - CVE CVE-2020-36632 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-36632

Vulnerability Analysis

The vulnerability exists in the unflatten function of the flat package, a popular Node.js library used to flatten and unflatten nested JavaScript objects. When processing specially crafted input containing prototype pollution payloads (such as __proto__ or constructor.prototype), the function fails to properly sanitize object keys before assigning values.

This prototype pollution flaw (CWE-1321) allows an attacker to inject arbitrary properties into Object.prototype, which then propagates to all JavaScript objects in the application. The impact is significant because:

1. The vulnerability is exploitable remotely through any application endpoint that processes user-controlled data using the unflatten function
2. No authentication or special privileges are required to trigger the vulnerability
3. Successful exploitation can lead to denial of service, authentication bypass, or in some cases, remote code execution depending on how the application uses the polluted properties

Root Cause

The root cause lies in insufficient validation of object keys during the unflattening process. The unflatten function recursively builds nested objects from flattened key-value pairs (e.g., {"a.b.c": 1} becomes {a: {b: {c: 1}}}). When a key contains __proto__ or similar prototype chain references, the function directly assigns values to these properties without sanitization, allowing pollution of the base Object.prototype.

Attack Vector

The attack is network-based and can be executed remotely without any user interaction or authentication. An attacker crafts a malicious JSON object with keys like __proto__.polluted or constructor.prototype.polluted and sends it to an application endpoint that processes this data using the vulnerable unflatten function.

The vulnerability mechanism works by passing crafted input to the unflatten function. When input containing keys like __proto__.isAdmin with a value of true is processed, the function fails to sanitize the prototype reference in the key. As a result, the isAdmin property is assigned to Object.prototype, causing all subsequently created objects to inherit this polluted property. For detailed technical analysis, see the GitHub Issue #105 which documents the vulnerability.

Detection Methods for CVE-2020-36632

Indicators of Compromise

• Presence of flat package version 5.0.0 or earlier in package.json or package-lock.json files
• Unexpected properties appearing on JavaScript objects that weren't explicitly set
• Application behavior changes or crashes related to prototype chain corruption
• Log entries showing unusual object property access patterns

Detection Strategies

• Run npm audit or yarn audit to identify vulnerable flat package versions in your dependency tree
• Use static analysis tools like Snyk, npm-audit, or GitHub Dependabot to scan for CVE-2020-36632
• Implement runtime monitoring for prototype pollution attacks by freezing Object.prototype in test environments
• Review application code for usage of the unflatten function with untrusted input

Monitoring Recommendations

• Enable dependency vulnerability scanning in CI/CD pipelines to catch vulnerable package versions
• Monitor application logs for unexpected property access errors that may indicate prototype pollution
• Implement Content Security Policy (CSP) headers to limit impact if prototype pollution leads to XSS
• Set up alerts for npm security advisories related to the flat package

How to Mitigate CVE-2020-36632

Immediate Actions Required

• Upgrade the flat package to version 5.0.1 or later immediately
• Run npm update flat or yarn upgrade flat to update the package
• Audit applications for direct and transitive dependencies on vulnerable versions using npm ls flat
• Review all code paths where unflatten processes user-controlled input

Patch Information

The vulnerability is addressed in flat version 5.0.1. The fix was implemented in commit 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. The patch adds proper sanitization of object keys to prevent prototype pollution through __proto__ and similar prototype chain references. For details, see the GitHub Commit Reference and GitHub Pull Request #106. The patched version is available at GitHub Release 5.0.1.

Workarounds

• Validate and sanitize all user input before passing to the unflatten function, rejecting keys containing __proto__, constructor, or prototype
• Freeze Object.prototype using Object.freeze(Object.prototype) to prevent modification, though this may break some legitimate functionality
• Use the safe-flat alternative package or implement custom unflattening logic with proper key sanitization
• Implement input validation middleware to block prototype pollution payloads at the application boundary

# Configuration example
# Update flat package to patched version
npm update flat

# Verify installed version
npm ls flat

# Alternative: Force update to specific version
npm install flat@5.0.1

# Audit dependencies for vulnerabilities
npm audit