GHSA-593m-55hh-j8gv

What it actually does

The advisory describes an improper input validation issue that can allow attacker-controlled object properties to influence application behavior through a prototype-pollution-style gadget. In affected code paths, specially crafted input containing prototype-related keys may be merged, deserialized, or processed without sufficient key filtering, causing inherited object properties to be modified or unexpectedly resolved. The supplied package metadata identifies org.apache.hadoop:hadoop-common as affected and fixed in version 2.7.4; because the title/description and package metadata are not fully aligned, teams should validate the advisory-to-package mapping in their dependency tooling while still treating hadoop-common versions before 2.7.4 as vulnerable per the fixed-version data.

Why it matters to the business

Successful exploitation could cause unpredictable application behavior, bypass expected validation logic, corrupt data processing outcomes, or enable follow-on abuse in systems that consume untrusted input through the affected dependency. The CVSS score is moderate, there is no known KEV listing, no ransomware association, and no reported public exploit maturity in the supplied data, so this should generally be prioritized behind actively exploited critical vulnerabilities but still remediated during normal patch cycles, especially in widely deployed data-processing or backend platforms.

How an attack unfolds

An attacker first identifies an application or service that includes the affected dependency and exposes a reachable input path that is processed by the vulnerable component or gadget. The attacker then submits crafted data containing keys such as prototype-related properties, nested object paths, or unexpected inherited-property names. If the application merges or interprets this data without filtering dangerous property names, the polluted property can alter later application logic. Depending on how the application uses the affected objects, the impact may range from denial of service or incorrect processing to authorization or validation bypass in downstream code. No specific public exploitation or named threat actor activity is indicated by the supplied data.

How to fix it

Upgrade org.apache.hadoop:hadoop-common to version 2.7.4 or later wherever it is present as a direct or transitive Maven dependency. Regenerate dependency lockfiles, rebuild artifacts, and redeploy applications after the upgrade. If immediate upgrade is not possible, reduce exposure by blocking or sanitizing untrusted structured input before it reaches affected code paths, rejecting dangerous property names such as __proto__, prototype, and constructor where applicable, and limiting access to APIs or jobs that process externally supplied data. Because the advisory text references a JavaScript prototype-pollution gadget while the package metadata references a Maven Hadoop package, confirm the correct affected component in SCA, SBOM, and build manifests before closing remediation work.

How to confirm the fix worked

Confirm that no deployed artifact includes org.apache.hadoop:hadoop-common below 2.7.4 by checking Maven dependency trees, SBOMs, container images, shaded JARs, application packages, and runtime classpaths. Use commands such as mvn dependency:tree, gradle dependencies, SBOM scanners, and container filesystem searches for hadoop-common-*.jar. Validate that rebuilt deployments actually load the fixed dependency at runtime, not only in source control. Where input filtering is used as a mitigation, test representative endpoints and jobs with benign payloads containing __proto__, constructor, and prototype keys and confirm they are rejected, normalized, or treated as ordinary inert data without changing application behavior.

Typical attack path

1. Identify an application, API, data-processing job, or service using a vulnerable version of org.apache.hadoop:hadoop-common or the affected advisory component.
2. Find an input vector that accepts structured attacker-controlled data, configuration, serialized content, request parameters, or metadata.
3. Send crafted input containing prototype-oriented or unexpected property names intended to alter object behavior.
4. Trigger application code that merges, maps, deserializes, or otherwise processes the crafted input through the vulnerable dependency or gadget.
5. Abuse the resulting altered behavior to cause incorrect processing, bypass logic checks, trigger errors, or support follow-on exploitation depending on the application context.

How to detect it

To assess prior exploitation, review application logs, API gateway logs, WAF events, reverse proxy logs, request bodies where retained, job submission records, message queue payload logs, and exception traces for structured inputs containing prototype-pollution keywords. Focus on requests or jobs that include __proto__, constructor.prototype, constructor[prototype], or nested prototype fields, especially if followed by server errors, validation anomalies, authorization anomalies, failed deserialization, or unexpected configuration changes. For Hadoop or JVM-based deployments, also review job history, YARN application logs, service logs, and container stdout/stderr around suspicious submissions. There are no supplied threat actors, public exploit artifacts, or known compromise-specific indicators, so detection should be behavior- and payload-focused rather than relying on a definitive IOC list.

• __proto__
• constructor.prototype
• constructor[prototype]
• prototype.polluted
• prototype[polluted]
• Object.prototype
• hadoop-common-2.7.0.jar
• hadoop-common-2.7.1.jar
• hadoop-common-2.7.2.jar
• hadoop-common-2.7.3.jar

What your security team should do

• Inventory all applications, containers, batch jobs, and services that include org.apache.hadoop:hadoop-common, including transitive and shaded copies.
• Upgrade affected instances to org.apache.hadoop:hadoop-common 2.7.4 or later and prioritize internet-facing or externally fed data-processing systems first.
• Review SCA results for advisory/package mismatches and verify the affected component using dependency evidence rather than advisory title alone.
• Add input validation or schema enforcement for structured data accepted from untrusted sources, especially data that may be merged into objects or configuration maps.
• Search recent application, API gateway, WAF, and job-processing logs for prototype-pollution-style payload strings and unusual validation or processing failures.
• Monitor for abnormal application behavior after suspicious inputs, including repeated exceptions, unexpected authorization decisions, corrupted job parameters, or unexplained processing changes.