CVE-2024-12629 Overview
CVE-2024-12629 is a prototype pollution vulnerability [CWE-1321] affecting Progress Telerik KendoReact versions v3.5.0 through v9.4.0. An attacker can introduce or modify properties within the global JavaScript prototype chain. Successful exploitation can lead to denial of service or command injection in applications that consume the affected components.
KendoReact is a widely deployed React UI component library used in enterprise web applications. The flaw exposes any application built on vulnerable versions to server-side or client-side manipulation of Object.prototype, depending on how KendoReact APIs process untrusted input.
Critical Impact
Attackers with privileged access can pollute the global prototype chain, resulting in command injection or denial of service across applications built on affected KendoReact versions.
Affected Products
- Progress Telerik KendoReact v3.5.0 through v9.4.0
- React applications that import vulnerable KendoReact components
- Server-side rendered applications using KendoReact utilities
Discovery Timeline
- 2025-02-12 - CVE-2024-12629 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12629
Vulnerability Analysis
The vulnerability is a prototype pollution flaw classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Prototype pollution occurs when a program merges, clones, or assigns properties from user-controlled input into an object without validating reserved keys such as __proto__, constructor, or prototype.
When KendoReact processes crafted input containing these keys, the assignment propagates to Object.prototype. Every object in the JavaScript runtime then inherits the injected property. Downstream code that reads the polluted property can be diverted into unintended execution paths, including gadget chains that lead to command injection.
The attack requires network-accessible input handling but also assumes high privileges within the application, according to the CVSS vector. Impact spans confidentiality, integrity, and availability.
Root Cause
The root cause is unsafe property assignment within KendoReact utility or component code that recursively copies keys from untrusted objects. Without an allowlist of safe keys or a check against Object.hasOwn, attacker-controlled __proto__ entries are written directly onto the prototype chain.
Attack Vector
An authenticated attacker sends a JSON payload containing __proto__ keys to an application endpoint that forwards the data into a vulnerable KendoReact function. The polluted property then interacts with a gadget in the runtime, such as an option flag consumed by a child process spawn or a template renderer, producing command execution or a denial-of-service condition.
Refer to the Telerik Security Advisory 2024-12629 for vendor-provided technical details.
Detection Methods for CVE-2024-12629
Indicators of Compromise
- HTTP request bodies containing __proto__, constructor.prototype, or prototype keys in JSON payloads
- Unexpected properties appearing on standard JavaScript objects at runtime
- Anomalous child process invocations originating from Node.js application workers
- Application errors referencing undefined properties that suddenly resolve to attacker-controlled values
Detection Strategies
- Inspect application logs for JSON parsing events that include reserved prototype keys
- Add runtime instrumentation to alert when writes occur to Object.prototype
- Deploy WAF rules that block request bodies containing __proto__ or constructor.prototype in unexpected fields
- Perform software composition analysis to identify KendoReact versions between v3.5.0 and v9.4.0
Monitoring Recommendations
- Monitor process trees on Node.js hosts for unexpected exec, spawn, or shell invocations
- Track outbound network connections from web application servers for signs of post-exploitation activity
- Alert on repeated 5xx responses or worker crashes that indicate denial-of-service attempts
How to Mitigate CVE-2024-12629
Immediate Actions Required
- Upgrade Progress Telerik KendoReact to a version later than v9.4.0 as directed by the Telerik Security Advisory
- Audit application code for endpoints that accept user-controlled JSON and pass it to KendoReact utilities
- Restrict administrative and high-privilege access to the application until patches are applied
Patch Information
Progress has published guidance in the Telerik KendoReact Knowledge Base advisory. Update the @progress/kendo-react-* packages to the fixed release identified in the advisory and redeploy affected applications.
Workarounds
- Freeze Object.prototype at application startup using Object.freeze(Object.prototype) where compatible
- Sanitize inbound JSON to strip __proto__, constructor, and prototype keys before processing
- Use Map instead of plain objects for user-controlled key-value stores in server-side code
- Deploy strict input validation schemas that reject unexpected property names
# Configuration example: upgrade KendoReact packages
npm update @progress/kendo-react-common@latest
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
