CVE-2024-11628 Overview
CVE-2024-11628 is a prototype pollution vulnerability in Progress Telerik Kendo UI for Vue, affecting versions v2.4.0 through v6.0.1. An attacker can introduce or modify properties within the global prototype chain, leading to denial of service or command injection. The flaw is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes. Progress Software published a security advisory documenting the issue and providing remediation guidance for affected Vue.js applications.
Critical Impact
Successful exploitation enables command injection or denial of service through manipulation of the JavaScript global prototype chain in applications using vulnerable Kendo UI for Vue components.
Affected Products
- Progress Telerik Kendo UI for Vue v2.4.0 through v6.0.1
- Vue.js applications embedding vulnerable Kendo UI for Vue components
- Downstream products bundling affected Kendo UI for Vue versions
Discovery Timeline
- 2025-02-12 - CVE-2024-11628 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11628
Vulnerability Analysis
The vulnerability is a prototype pollution flaw in Kendo UI for Vue. Prototype pollution occurs when untrusted input reaches code that recursively merges, clones, or assigns object properties without validating keys such as __proto__, constructor, or prototype. Because JavaScript objects inherit from Object.prototype, modifying that shared prototype affects every object in the running application.
An attacker with authenticated access can inject properties into the global prototype chain by supplying crafted input to affected Kendo UI for Vue components or utilities. Once the prototype is polluted, downstream code that reads inherited properties observes attacker-controlled values. Depending on how the host application uses those properties, this leads to denial of service through unexpected control flow or command injection when polluted values reach a sink such as a shell execution or template evaluation path.
Root Cause
The root cause is improperly controlled modification of object prototype attributes [CWE-1321]. Vulnerable code paths in Kendo UI for Vue accept property names from input without filtering dangerous keys, allowing writes to Object.prototype.
Attack Vector
The attack vector is network based and requires high privileges but no user interaction. An authenticated attacker submits crafted JSON or configuration data to an application endpoint that flows into a vulnerable Kendo UI for Vue routine. The polluted prototype then influences later operations across the process, escalating impact to command injection or service disruption. Refer to the Telerik Security Advisory for component-specific technical details.
Detection Methods for CVE-2024-11628
Indicators of Compromise
- Requests containing payload keys such as __proto__, constructor.prototype, or prototype in JSON bodies or query parameters targeting Vue.js application endpoints.
- Unexpected properties appearing on base JavaScript objects at runtime, observable through application logging or heap inspection.
- Anomalous child process creation from Node.js server processes that host Kendo UI for Vue server-side rendering.
Detection Strategies
- Inspect HTTP request payloads at the web application firewall (WAF) or reverse proxy layer for prototype-pollution key patterns.
- Perform software composition analysis (SCA) against package.json and package-lock.json to identify @progress/kendo-vue-* versions in the vulnerable range v2.4.0 through v6.0.1.
- Enable runtime application self-protection (RASP) or Node.js instrumentation to flag writes to Object.prototype during request handling.
Monitoring Recommendations
- Log and alert on client requests that include reserved prototype keys in structured input.
- Monitor application error rates and unexpected process spawns following deserialization or configuration merge operations.
- Track dependency inventory continuously to detect reintroduction of vulnerable Kendo UI for Vue versions during builds.
How to Mitigate CVE-2024-11628
Immediate Actions Required
- Upgrade Progress Telerik Kendo UI for Vue to a version later than v6.0.1 as directed by the vendor advisory.
- Audit all Vue.js applications and internal packages for transitive dependencies on @progress/kendo-vue-* in the affected range.
- Restrict access to authenticated endpoints that accept structured input consumed by Kendo UI for Vue components.
Patch Information
Progress Software published remediation guidance in the Telerik Security Advisory #2024-11628. Apply the vendor-supplied fixed release and rebuild affected Vue.js applications. Verify the resolved version in package-lock.json and redeploy to all environments.
Workarounds
- Validate and sanitize input keys server-side, explicitly rejecting __proto__, constructor, and prototype before merge or assignment operations.
- Freeze Object.prototype at Node.js process startup using Object.freeze(Object.prototype) where application compatibility allows.
- Replace unsafe recursive merge helpers with safe alternatives that use Object.create(null) or a Map for user-controlled data.
# Configuration example: identify vulnerable Kendo UI for Vue packages
npm ls @progress/kendo-vue-inputs @progress/kendo-vue-grid @progress/kendo-vue-dropdowns
# Upgrade to a fixed release per Telerik advisory
npm install @progress/kendo-vue-inputs@latest
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
