CVE-2021-44906: Minimist Prototype Pollution Vulnerability

CVE-2021-44906 Overview

CVE-2021-44906 is a Prototype Pollution vulnerability affecting Minimist versions 1.2.5 and earlier. The vulnerability exists in the setKey() function within index.js (lines 69-95), which fails to properly sanitize user-controlled input when parsing command-line arguments. This flaw allows attackers to inject properties into JavaScript Object prototypes, potentially leading to application-wide security compromises.

Minimist is a widely-used argument parsing library for Node.js applications with millions of weekly downloads, making this vulnerability particularly impactful across the JavaScript ecosystem.

Critical Impact

Attackers can exploit this Prototype Pollution vulnerability to modify Object prototypes, potentially achieving remote code execution, denial of service, or bypassing security controls in applications using vulnerable Minimist versions.

Affected Products

• Substack Minimist versions ≤1.2.5
• Node.js applications using vulnerable Minimist as a dependency
• Downstream packages and applications that transitively depend on Minimist

Discovery Timeline

• 2022-03-17 - CVE CVE-2021-44906 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-44906

Vulnerability Analysis

This vulnerability is classified as Prototype Pollution (CWE-1321), a class of vulnerabilities specific to JavaScript and similar prototype-based languages. The setKey() function in Minimist's index.js fails to properly validate property keys before assigning values to objects during command-line argument parsing.

When Minimist parses arguments like --__proto__.polluted=true, the function traverses the object chain using the provided key path without checking for dangerous prototype properties. This allows an attacker to inject arbitrary properties into Object.prototype, which are then inherited by all objects in the JavaScript application.

The exploitation potential is significant because polluted prototype properties can affect security-critical operations throughout the application, including authentication checks, access control decisions, and dynamic code execution paths.

Root Cause

The root cause lies in the setKey() function's lack of input sanitization for special JavaScript object properties. The function directly uses user-supplied key names to traverse and modify object properties without filtering dangerous keys like __proto__, constructor, or prototype. This oversight allows attackers to escape the intended object scope and modify the base Object prototype.

Attack Vector

The attack vector is network-based, as vulnerable applications may process command-line arguments derived from user input, API requests, or configuration files. An attacker can craft malicious input containing prototype pollution payloads that, when parsed by Minimist, inject properties into all JavaScript objects within the application.

For example, passing arguments structured to target __proto__ properties causes the parser to modify the Object prototype. Subsequent code that relies on default object behavior or checks for property existence may behave unexpectedly, leading to security bypasses.

The vulnerability mechanism involves the setKey() function at lines 69-95 of index.js. When processing nested argument keys, the function recursively traverses object properties without checking if the key matches reserved prototype properties. A proof-of-concept demonstrating this behavior is available in the vulnerability detection repository.

Detection Methods for CVE-2021-44906

Indicators of Compromise

• Unexpected application behavior or crashes following argument parsing operations
• Log entries showing unusual property names containing __proto__, constructor, or prototype
• Application logic bypasses or authentication failures that cannot be explained by normal operations
• Memory anomalies or object property inconsistencies in Node.js applications

Detection Strategies

• Implement Software Composition Analysis (SCA) scanning to identify Minimist versions ≤1.2.5 in dependency trees
• Use npm audit or yarn audit to detect known vulnerabilities in Node.js dependencies
• Deploy runtime application protection that monitors for prototype pollution attempts
• Review application logs for arguments containing prototype-related keywords

Monitoring Recommendations

• Enable verbose logging for command-line argument parsing in Node.js applications
• Monitor for unexpected object property modifications using Node.js debugging tools
• Implement integrity checks for critical object properties in security-sensitive code paths
• Set up alerts for dependency vulnerability disclosures affecting Minimist

How to Mitigate CVE-2021-44906

Immediate Actions Required

• Update Minimist to version 1.2.6 or later immediately across all affected applications
• Audit your application's dependency tree using npm ls minimist to identify all instances of the vulnerable package
• Review and test applications after patching to ensure compatibility with the updated version
• Consider implementing Object.freeze() on critical objects as an additional defense layer

Patch Information

The vulnerability has been addressed in Minimist versions after 1.2.5. Users should upgrade to the latest available version. For detailed information about the vulnerability and remediation, refer to the GitHub issue discussion and the Snyk vulnerability report.

Organizations using enterprise software that bundles Minimist should also review the NetApp Security Advisory for product-specific guidance.

Workarounds

• Implement input validation to reject arguments containing __proto__, constructor, or prototype before passing to Minimist
• Use Object.create(null) for objects that will receive parsed argument data to create prototype-less objects
• Consider alternative argument parsing libraries that include prototype pollution protections
• Apply application-level freezing of Object.prototype in controlled environments (note: may affect application functionality)

# Update Minimist to patched version
npm update minimist

# Audit for vulnerable dependencies
npm audit

# Check for Minimist instances in dependency tree
npm ls minimist

# Force resolution to patched version in package.json
npm pkg set overrides.minimist=">=1.2.6"