CVE-2021-23436: Immer Auth Bypass Vulnerability

CVE-2021-23436 Overview

CVE-2021-23436 is a type confusion vulnerability affecting the popular Immer JavaScript library before version 9.0.6. This vulnerability allows attackers to bypass a previous prototype pollution fix (CVE-2020-28477) by exploiting JavaScript's strict equality operator behavior when comparing arrays to strings. Immer is widely used in React applications for immutable state management, making this vulnerability particularly impactful across the JavaScript ecosystem.

Critical Impact

This type confusion flaw enables attackers to achieve prototype pollution by supplying array-based keys in the path parameter, potentially leading to remote code execution, denial of service, or property injection attacks in Node.js applications using vulnerable Immer versions.

Affected Products

• Immer_project Immer (versions prior to 9.0.6)
• Node.js applications using vulnerable Immer versions
• Java applications using Immer via WebJars (org.webjars.npm)

Discovery Timeline

• September 1, 2021 - CVE-2021-23436 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-23436

Vulnerability Analysis

CVE-2021-23436 represents a type confusion vulnerability (CWE-843) that enables attackers to circumvent the prototype pollution protections previously implemented to address CVE-2020-28477. The vulnerability exists within the applyPatches_ function of the Immer library, where inadequate type checking allows malicious input to bypass security controls.

The core issue stems from how JavaScript's strict equality operator (===) handles comparisons between different data types. When the library attempts to validate user-provided path keys against dangerous property names like __proto__ or constructor, it uses strict equality comparison. This comparison returns false when comparing a string to an array, even if the array contains the same string value.

This flaw is particularly concerning given Immer's widespread adoption in React-based applications for managing immutable state. Successful exploitation could allow attackers to modify object prototypes, potentially leading to arbitrary property injection, denial of service, or in certain application contexts, remote code execution.

Root Cause

The root cause is a type confusion issue in the path parameter validation logic within the applyPatches_ function. The condition (p === "__proto__" || p === "constructor") fails to account for cases where p is an array containing these string values (e.g., ['__proto__']). Since JavaScript's strict equality operator returns false when comparing operands of different types, passing an array instead of a string effectively bypasses the security check.

Attack Vector

The attack is network-exploitable with low complexity and requires no privileges or user interaction. An attacker can craft malicious input where path keys are provided as arrays containing dangerous property names rather than as plain strings. When the Immer library processes patches with these array-based keys, the prototype pollution bypass is triggered.

The attack exploits the type coercion behavior in JavaScript where arrays can be implicitly converted to strings in certain contexts (like property access), but fail strict equality checks against string values. This allows an attacker to:

1. Supply a patch operation with a path containing ['__proto__'] as an array element
2. Bypass the string-based security check in applyPatches_
3. Successfully pollute the prototype chain of objects processed by Immer

Detection Methods for CVE-2021-23436

Indicators of Compromise

• Unexpected modifications to Object.prototype properties in Node.js application memory
• Application crashes or unexpected behavior following the processing of user-controlled patch data
• Unusual property values appearing across multiple unrelated objects in the application state
• Error logs indicating prototype-related issues or unexpected property access patterns

Detection Strategies

• Implement software composition analysis (SCA) to identify Immer versions below 9.0.6 in your dependency tree
• Monitor application logs for abnormal patch operations containing array-based path elements
• Deploy runtime application self-protection (RASP) solutions to detect prototype pollution attempts
• Use static analysis tools to identify code paths where user input flows into Immer's applyPatches function

Monitoring Recommendations

• Enable verbose logging for state management operations in applications using Immer
• Monitor for attempts to access or modify __proto__ or constructor properties in application state
• Implement input validation monitoring to detect array-based path parameters in patch operations
• Track dependency versions in CI/CD pipelines to ensure vulnerable Immer packages are flagged

How to Mitigate CVE-2021-23436

Immediate Actions Required

• Upgrade Immer to version 9.0.6 or later immediately across all projects
• Audit application code for direct usage of applyPatches with user-controlled input
• Implement input validation to reject array-based path parameters before they reach Immer
• Review package-lock.json and yarn.lock files to identify transitive dependencies on vulnerable Immer versions

Patch Information

The Immer maintainers have addressed this vulnerability in version 9.0.6. The fix implements proper type checking to handle cases where path keys are provided as arrays. The security patch is available via the GitHub commit.

For detailed vulnerability information, refer to the Snyk JavaScript advisory and the Snyk Java WebJars advisory.

Workarounds

• Implement strict input validation to ensure path parameters are strings, not arrays, before passing to Immer
• Use Object.freeze on critical prototypes to prevent modification as a defense-in-depth measure
• Consider wrapping Immer's applyPatches function with custom validation logic that rejects array-based keys
• Isolate state management operations in sandboxed environments where prototype pollution impact is limited

# Update Immer to patched version
npm update immer@^9.0.6

# Or install specific patched version
npm install immer@9.0.6

# Audit for vulnerable dependencies
npm audit --production