CVE-2024-54156: JetBrains YouTrack Prototype Pollution

CVE-2024-54156 Overview

CVE-2024-54156 is a prototype pollution vulnerability affecting JetBrains YouTrack versions prior to 2024.3.52635. Multiple merge functions in the application accept attacker-controlled input without properly validating object keys. Attackers can inject properties into Object.prototype, altering the behavior of downstream code paths. The flaw is network-exploitable and requires no authentication or user interaction. The issue is tracked under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.

Critical Impact
Unauthenticated attackers can pollute JavaScript object prototypes to modify application logic, leak limited information, or corrupt integrity of processed data in JetBrains YouTrack.

Affected Products

JetBrains YouTrack versions before 2024.3.52635
Self-hosted YouTrack Server deployments
YouTrack instances exposed to untrusted networks

Discovery Timeline

2024-12-04 - CVE-2024-54156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54156

Vulnerability Analysis

The vulnerability stems from unsafe recursive merge operations that copy properties from a source object into a target object. When the merge routine encounters keys such as __proto__, constructor, or prototype, it walks into the prototype chain instead of treating them as literal own-properties. Attackers submit crafted JSON payloads that traverse into Object.prototype and add or overwrite global properties.

Once the prototype is polluted, every plain object inherited from Object.prototype sees the injected property. Downstream code paths that check for optional flags or feature toggles then read attacker-supplied values, changing application behavior. The CVSS impact profile indicates limited confidentiality and integrity effects, with no direct availability loss.

Root Cause

The root cause is missing key filtering in merge helper functions. Safe merge implementations reject reserved keys or use Object.create(null) for intermediate objects. The affected YouTrack builds recursively assigned nested properties without either safeguard, allowing prototype chain traversal during deep-merge operations.

Attack Vector

An unauthenticated remote attacker submits a JSON body to a YouTrack endpoint that internally invokes one of the vulnerable merge functions. The payload embeds a __proto__ key whose child object contains attacker-controlled properties. After processing, subsequent requests observe the polluted prototype, enabling logic tampering. See the JetBrains Fixed Security Issues page for vendor-published details on the affected code paths.

Detection Methods for CVE-2024-54156

Indicators of Compromise

HTTP request bodies to YouTrack endpoints containing __proto__, constructor.prototype, or prototype keys within JSON payloads
Unexpected changes to feature flags, permission checks, or default values across YouTrack sessions following inbound API traffic
YouTrack application errors or anomalous responses that reference prototype-inherited properties not defined in configuration

Detection Strategies

Inspect reverse proxy and application logs for JSON payloads containing reserved prototype keys sent to YouTrack REST endpoints
Deploy web application firewall rules that block requests carrying __proto__ or constructor.prototype keys targeting /api/ and administrative paths
Compare running YouTrack build numbers against the fixed release 2024.3.52635 and alert on outdated instances

Monitoring Recommendations

Enable verbose access logging on the YouTrack front-end and forward logs to a centralized analytics platform for keyword search on prototype pollution patterns
Monitor for authentication or authorization anomalies that could indicate polluted logic flags, such as unexpected privilege elevation
Track outbound network activity from the YouTrack host for signs of secondary exploitation following prototype pollution

How to Mitigate CVE-2024-54156

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2024.3.52635 or later as documented on the JetBrains Fixed Security Issues page
Restrict network exposure of YouTrack management and API endpoints to trusted networks or VPN users only
Audit recent API traffic for JSON payloads containing prototype-related keys and investigate any matches

Patch Information

JetBrains resolved the issue in YouTrack 2024.3.52635 by hardening the affected merge routines against reserved prototype keys. Administrators should apply the update through the standard YouTrack upgrade procedure and confirm the running version after installation. Refer to the vendor advisory for exact build metadata.

Workarounds

Place YouTrack behind a reverse proxy or WAF that strips or rejects JSON keys named __proto__, constructor, and prototype
Limit API access to authenticated internal users via network ACLs until the patched build is deployed
Reduce administrative account exposure and rotate API tokens if suspicious payloads are found in access logs

bash

# Configuration example: sample NGINX rule to block prototype pollution payloads
location /api/ {
    if ($request_body ~* "(__proto__|constructor\.prototype|\"prototype\"\s*:)") {
        return 400;
    }
    proxy_pass http://youtrack_backend;
}