CVE-2024-38996: Ag-grid Prototype Pollution Vulnerability

CVE-2024-38996 Overview

A prototype pollution vulnerability has been identified in ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) by injecting arbitrary properties into JavaScript object prototypes. Prototype pollution attacks can have severe consequences, enabling attackers to modify the behavior of legitimate code paths and potentially gain full control over affected applications.

Critical Impact

Attackers can inject malicious properties into object prototypes, leading to arbitrary code execution or denial of service in applications using vulnerable ag-grid versions.

Affected Products

• ag-grid-community v31.3.2
• ag-grid-enterprise v31.3.2
• Applications utilizing vulnerable ag-grid versions

Discovery Timeline

• 2024-07-01 - CVE-2024-38996 published to NVD
• 2025-04-28 - Last updated in NVD database

Technical Details for CVE-2024-38996

Vulnerability Analysis

The vulnerability resides in the _.mergeDeep function within ag-grid's codebase. Prototype pollution occurs when an attacker can inject properties into JavaScript's base object prototype (Object.prototype). Since most JavaScript objects inherit from Object.prototype, any property added to it becomes available on all objects throughout the application.

In this case, the _.mergeDeep function fails to properly sanitize input when recursively merging objects. An attacker can craft malicious input containing special properties like __proto__, constructor, or prototype that, when processed by the merge operation, pollute the global object prototype.

Root Cause

The root cause is improper input validation in the deep merge operation. The _.mergeDeep function does not adequately check for or filter out prototype-related properties (__proto__, constructor.prototype) before performing recursive object merging. This allows attacker-controlled input to modify the prototype chain of JavaScript objects.

This is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')).

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by supplying malicious JSON or object data to an application that processes it through the vulnerable _.mergeDeep function.

The exploitation typically involves:

1. Identifying an input vector where user-controlled data reaches the vulnerable function
2. Crafting a payload with prototype pollution properties (e.g., {"__proto__": {"polluted": true}})
3. Triggering the merge operation to inject properties into the global prototype
4. Leveraging polluted properties to achieve code execution or denial of service

Technical details and proof-of-concept information can be found in the researcher's GitHub Gist references.

Detection Methods for CVE-2024-38996

Indicators of Compromise

• Unexpected properties appearing on base JavaScript objects in application memory
• Anomalous application behavior suggesting prototype chain modification
• Server-side errors indicating type confusion or unexpected property access
• Unusual JSON payloads containing __proto__, constructor, or prototype keys in application logs

Detection Strategies

• Implement runtime prototype integrity monitoring to detect unauthorized modifications to Object.prototype
• Deploy Web Application Firewall (WAF) rules to filter requests containing prototype pollution payloads
• Use Static Application Security Testing (SAST) tools to identify usage of vulnerable ag-grid versions
• Monitor for unusual patterns in application telemetry indicating prototype pollution attempts

Monitoring Recommendations

• Enable detailed logging for data processing functions that handle user input
• Implement integrity checks on critical object prototypes at application startup and periodically during runtime
• Set up alerts for application exceptions related to unexpected property access or type errors
• Monitor npm/dependency management systems for vulnerable package versions

How to Mitigate CVE-2024-38996

Immediate Actions Required

• Audit your application dependencies to identify usage of ag-grid-community v31.3.2 or ag-grid-enterprise v31.3.2
• Update to a patched version of ag-grid when available from the vendor
• Implement input validation to reject objects containing prototype pollution properties
• Review application code paths that process untrusted data through deep merge operations

Patch Information

Organizations should monitor ag-grid's official release channels for security patches addressing this vulnerability. Check the ag-grid GitHub repository and official documentation for patched versions.

Until an official patch is available, consider implementing defensive measures at the application level.

Workarounds

• Implement a sanitization wrapper around object merge operations that strips __proto__, constructor, and prototype properties
• Freeze Object.prototype using Object.freeze() where feasible to prevent modification
• Use Object.create(null) for objects that process untrusted data to create objects without a prototype chain
• Validate all user input against an allowlist before processing through merge operations

// Example sanitization function
function sanitizeObject(obj) {
  if (obj === null || typeof obj !== 'object') {
    return obj;
  }
  
  const sanitized = Array.isArray(obj) ? [] : {};
  
  for (const key of Object.keys(obj)) {
    // Block prototype pollution vectors
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      continue;
    }
    sanitized[key] = sanitizeObject(obj[key]);
  }
  
  return sanitized;
}