CVE-2023-26136: Tough-cookie Prototype Pollution Flaw

CVE-2023-26136 Overview

CVE-2023-26136 is a Prototype Pollution vulnerability affecting the Salesforce tough-cookie package, a popular Node.js library used for HTTP cookie handling. Versions prior to 4.1.3 are vulnerable due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which objects are initialized, allowing attackers to inject properties into Object prototypes that can lead to denial of service, property injection, or in some cases remote code execution.

Critical Impact

This vulnerability allows attackers to pollute JavaScript Object prototypes via specially crafted cookie values, potentially leading to remote code execution, denial of service, or application logic bypass in Node.js applications using the affected library.

Affected Products

• salesforce tough-cookie (versions prior to 4.1.3)
• Node.js applications using vulnerable tough-cookie versions
• Applications with CookieJar configured in rejectPublicSuffixes=false mode

Discovery Timeline

• 2023-07-01 - CVE-2023-26136 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-26136

Vulnerability Analysis

The vulnerability exists in the tough-cookie library's memory store implementation (lib/memstore.js). When the CookieJar is instantiated, the internal index object (this.idx) was initialized using an empty object literal {}. This seemingly innocuous initialization creates an object that inherits from Object.prototype, making it susceptible to prototype pollution attacks.

When cookies are stored with specially crafted domain or path values (such as __proto__), an attacker can inject arbitrary properties into the base Object prototype. Since all JavaScript objects inherit from Object.prototype, these injected properties become accessible across the entire application, potentially allowing attackers to modify application behavior, bypass security checks, or cause denial of service conditions.

Root Cause

The root cause is the use of a standard object literal {} for initializing the cookie storage index. This creates an object with a prototype chain connected to Object.prototype. When cookie domains are used as keys to store cookie data, an attacker-controlled domain value of __proto__ causes properties to be written directly to the Object prototype rather than the intended storage object.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP responses with malicious Set-Cookie headers to an application using the vulnerable tough-cookie library with rejectPublicSuffixes=false. The crafted cookie domain or path values can target the __proto__ property, injecting malicious properties into the global Object prototype.

// Vulnerable code pattern (before fix):
constructor() {
  super();
  this.synchronous = true;
  this.idx = {};  // Vulnerable: inherits from Object.prototype
  const customInspectSymbol = getCustomInspectSymbol();
  if (customInspectSymbol) {
    this[customInspectSymbol] = this.inspect;
  }
}

// Fixed code pattern (after patch):
constructor() {
  super();
  this.synchronous = true;
  this.idx = Object.create(null);  // Secure: no prototype chain
  const customInspectSymbol = getCustomInspectSymbol();
  if (customInspectSymbol) {
    this[customInspectSymbol] = this.inspect;
  }
}

Source: GitHub Commit Update

Detection Methods for CVE-2023-26136

Indicators of Compromise

• Unexpected application behavior or crashes in Node.js applications using tough-cookie
• Cookie values containing __proto__, constructor, or prototype keywords in HTTP requests/responses
• Unusual modifications to global object properties during runtime
• Application logic bypasses or authentication anomalies

Detection Strategies

• Implement Software Composition Analysis (SCA) scanning to identify vulnerable tough-cookie versions in your dependency tree
• Monitor for HTTP traffic containing suspicious cookie domain/path values targeting prototype properties
• Use runtime application self-protection (RASP) solutions to detect prototype pollution attempts
• Review application logs for unexpected type errors or property access patterns

Monitoring Recommendations

• Enable verbose logging for cookie handling operations in applications using tough-cookie
• Implement alerts for dependency vulnerabilities using tools like npm audit, Snyk, or SentinelOne's application security monitoring
• Monitor network traffic for anomalous Set-Cookie headers with unusual domain patterns
• Deploy SentinelOne Singularity to detect exploitation attempts at runtime

How to Mitigate CVE-2023-26136

Immediate Actions Required

• Upgrade tough-cookie to version 4.1.3 or later immediately
• Run npm audit or yarn audit to identify vulnerable packages in your Node.js projects
• Review applications for use of rejectPublicSuffixes=false configuration and assess if it's necessary
• Scan container images and production deployments for vulnerable library versions

Patch Information

Salesforce has released version 4.1.3 of tough-cookie which addresses this vulnerability. The fix replaces the vulnerable object initialization this.idx = {} with this.idx = Object.create(null), creating an object with no prototype chain that is immune to prototype pollution attacks.

Patch resources:

• GitHub Release v4.1.3
• GitHub Commit Update
• GitHub Issue Discussion

Additional advisories have been published by Debian LTS, Fedora, and NetApp.

Workarounds

• If immediate upgrade is not possible, avoid using rejectPublicSuffixes=false mode in CookieJar configuration
• Implement input validation to reject cookies with domains containing __proto__, constructor, or prototype
• Use Object.freeze() on critical application objects to prevent prototype modification
• Consider implementing a Content Security Policy to limit the impact of potential exploitation

# Update tough-cookie to the patched version
npm update tough-cookie

# Or specify the minimum safe version in package.json
npm install tough-cookie@^4.1.3

# Audit your project for vulnerable dependencies
npm audit fix

# For yarn users
yarn upgrade tough-cookie@^4.1.3
yarn audit