CVE-2024-38986: 75lb Deep-merge RCE Vulnerability

CVE-2024-38986 Overview

CVE-2024-38986 is a critical Prototype Pollution vulnerability affecting the 75lb deep-merge JavaScript library version 1.1.1. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) by exploiting the merge methods to manipulate object prototypes. Prototype pollution attacks can have severe consequences in JavaScript applications, enabling attackers to modify the behavior of all objects in the application.

Critical Impact

Attackers can exploit prototype pollution to achieve remote code execution, denial of service, and other severe security impacts through manipulation of JavaScript object prototypes via the merge functionality.

Affected Products

• 75lb deep-merge version 1.1.1
• Applications using vulnerable versions of the deep-merge package
• Node.js applications implementing deep-merge for object merging operations

Discovery Timeline

• 2024-07-30 - CVE-2024-38986 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38986

Vulnerability Analysis

Prototype Pollution is a vulnerability class specific to JavaScript that exploits the language's prototype-based inheritance model. In the case of CVE-2024-38986, the 75lb deep-merge library fails to properly sanitize user-controlled input when performing recursive object merging operations.

When an attacker provides a malicious payload containing properties like __proto__ or constructor.prototype, the merge function inadvertently assigns these properties to the base Object prototype. This pollutes the prototype chain, causing all objects in the application to inherit the attacker-controlled properties.

The vulnerability is particularly dangerous because it can be triggered remotely through any application endpoint that accepts JSON input and processes it through the vulnerable merge function.

Root Cause

The root cause of this vulnerability lies in insufficient validation and sanitization of property keys during the deep merge operation. The deep-merge library recursively iterates through source objects and copies their properties to target objects without checking for special prototype properties.

When processing nested objects, the library does not exclude dangerous keys such as __proto__, constructor, or prototype. This allows an attacker to inject properties that will be assigned to Object.prototype, affecting all objects in the application runtime.

Attack Vector

The attack vector for CVE-2024-38986 is network-based, requiring no authentication or user interaction. An attacker can craft a malicious JSON payload containing prototype pollution gadgets and send it to any application endpoint that processes the input through the vulnerable deep-merge function.

The exploitation typically follows this pattern:

1. The attacker identifies an endpoint that accepts JSON input
2. The application uses deep-merge to combine user input with existing objects
3. The attacker injects a payload containing __proto__ or constructor.prototype properties
4. The merge operation pollutes the global Object prototype
5. Subsequent object operations inherit attacker-controlled properties

A proof-of-concept demonstrating this vulnerability is available in the GitHub Gist PoC Repository, which shows how malicious payloads can be constructed to exploit the vulnerable merge methods.

Detection Methods for CVE-2024-38986

Indicators of Compromise

• Unusual HTTP requests containing __proto__ or constructor strings in JSON payloads
• Application crashes or unexpected behavior following object operations
• Error logs indicating unexpected property access or type errors across multiple objects
• Memory usage anomalies caused by polluted prototype chains

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing prototype pollution payloads
• Enable runtime JavaScript monitoring to detect prototype modifications
• Conduct regular dependency audits using tools like npm audit or Snyk to identify vulnerable packages
• Review application logs for JSON parsing errors associated with suspicious property names

Monitoring Recommendations

• Monitor inbound HTTP traffic for JSON payloads containing __proto__, constructor, or prototype property names
• Implement application performance monitoring (APM) to detect sudden behavior changes in object operations
• Configure alerting for dependency scanner findings related to prototype pollution vulnerabilities
• Track package.json and lock file changes to detect introduction of vulnerable dependencies

How to Mitigate CVE-2024-38986

Immediate Actions Required

• Update the 75lb deep-merge package to a patched version if available
• Audit applications to identify all locations where deep-merge is used with user-controlled input
• Implement input validation to reject objects containing dangerous prototype properties
• Consider replacing deep-merge with alternative libraries that have prototype pollution protections

Patch Information

Organizations should check the 75lb deep-merge repository for security updates and patched versions. The vulnerability affects version 1.1.1, and users should upgrade to any available patched release. If no patch is available, consider migrating to alternative object merging libraries that implement prototype pollution safeguards.

For reference, the vulnerability proof-of-concept and additional technical details can be found at the GitHub Gist PoC Repository.

Workarounds

• Implement Object.freeze on Object.prototype to prevent prototype modifications (may affect application functionality)
• Create wrapper functions that sanitize input by removing dangerous keys before passing to deep-merge
• Use Object.create(null) for objects that will be merged with untrusted input to avoid prototype chain access
• Deploy input validation middleware to reject requests containing prototype pollution payloads

# Example: Checking for vulnerable deep-merge version in package.json
grep -r "deep-merge" package.json package-lock.json
npm ls deep-merge
# Consider upgrading or replacing the package if version 1.1.1 is detected