CVE-2021-44906

What it actually does

A prototype pollution vulnerability in the Minimist library allows an unauthenticated, remote attacker to modify the `Object.prototype` of a Node.js application. By crafting malicious input for argument parsing, an attacker can add or alter properties on the global object prototype. This can lead to a variety of secondary impacts, including denial of service, privilege escalation, and potentially remote code execution, depending on how the application's code interacts with the polluted properties.

Why it matters to the business

Minimist is an extremely common command-line argument parsing library, making this vulnerability prevalent across the Node.js ecosystem. A successful exploit can lead to a complete compromise of the affected application or service. This could result in the theft of sensitive data, service outages, and reputational damage. The high CVSS score of 9.8 indicates a critical risk, as an attacker can achieve a full system compromise without any user interaction or special privileges.

How an attack unfolds

An attacker identifies an application that uses a vulnerable version of the Minimist library to parse user-controlled input, such as from an HTTP request's query parameters or POST body. The attacker crafts a payload containing special property names like `__proto__` or `constructor.prototype`. When the application passes this input to Minimist, the library's flawed `setKey` function incorrectly interprets the payload and modifies the global `Object.prototype` instead of a local object. Later, when the application's code performs a property check (e.g., for an admin flag), it may inadvertently use the attacker-controlled value from the polluted prototype, leading to a security bypass or other unintended behavior.

How to fix it

The vulnerability is fixed in version 1.2.6. Update the `minimist` package to version 1.2.6 or later. Since `minimist` is often a transitive dependency, you may need to update the parent package that depends on it. Use `npm update minimist` or `yarn upgrade minimist` to apply the fix, and verify that the lockfile (`package-lock.json` or `yarn.lock`) reflects the updated, non-vulnerable version. If immediate patching is not possible, implement strict input validation to reject any keys containing `__proto__`, `constructor`, or `prototype` before they are passed to the library.

How to confirm the fix worked

To confirm remediation, check the project's dependency tree to ensure that all resolved versions of `minimist` are 1.2.6 or higher. This can be verified by running `npm ls minimist` or `yarn list --pattern minimist` in the project's root directory. Ensure that no sub-dependencies are still pulling in a vulnerable version.

Typical attack path

1. The attacker identifies a target application that uses a vulnerable version of the Minimist library (<=1.2.5) to parse user input.
2. The attacker crafts a malicious input string, such as `__proto__.isAdmin=true`, designed to be parsed by Minimist.
3. The attacker sends this payload to the application via an exposed endpoint (e.g., an API).
4. The Minimist library processes the input and pollutes the `Object.prototype` of the running Node.js process.
5. Subsequent code execution within the application is altered, potentially granting the attacker elevated privileges, causing a denial of service, or enabling remote code execution.

How to detect it

To detect potential exploitation attempts, security teams should monitor application and web server logs for incoming requests that contain prototype pollution payloads. Specifically, search for the strings `__proto__`, `constructor`, and `prototype` within URL query parameters, JSON request bodies, and other user-supplied input fields. An alert on these patterns, correlated with any subsequent anomalous application behavior like crashes or unexpected privilege changes, can indicate an active attack.

• __proto__
• constructor.prototype
• ["__proto__"]
• ["constructor"]["prototype"]

What your security team should do

• Immediately use a Software Composition Analysis (SCA) tool to identify all projects and systems that use a vulnerable version of the `minimist` package, including as a transitive dependency.
• Prioritize patching all identified instances to version 1.2.6 or later, as public exploits are available.
• If patching cannot be immediately deployed, configure Web Application Firewalls (WAFs) or other input filtering mechanisms to block requests containing patterns like `__proto__` or `constructor.prototype` in keys or parameters.