A recent CVE (Common Vulnerabilities and Exposures) has been reported, identified as CVE-2024-24293, which is related to a Prototype Pollution issue present in MiguelCastillo's popular @bit/loader library. The vulnerable module is reportedly found in version 10..3 of the library.

The security flaw allows an attacker to execute arbitrary code by passing a malicious input through the e argument of the M function in the index.js file. With this post, we'll dive deep into the details of this vulnerability, examine the related code snippet, and provide links to original references for further investigation and understanding.

Vulnerability Details

The vulnerability resides in the M function inside the index.js file of the @bit/loader library. This function is susceptible to Prototype Pollution which can be exploited by an attacker to execute arbitrary code by crafting a malicious input.

For a better understanding, let's take a look at the crucial piece of code in question

function M(e, t) {
  var n;
  for (var r in e) {
    n = e[r];
    if (Object.prototype.hasOwnProperty.call(t, r)) {
      t[r].push(n)
    } else {
      t[r] = [n]
    }
  }
}

As seen in the code snippet above, the M function accepts two arguments - 'e' and 't'. It uses a for-in loop to iterate over the properties of 'e'. The issue arises when an attacker can control the value of 'e' and inject harmful properties that can affect the prototype of other objects, thereby leading to Prototype Pollution.

In this context, an attacker can craft a malicious input that can execute arbitrary code. Such an execution might grant the attacker a higher level of access and control than they should have, and can potentially lead to more serious outcomes.

Original References

1. CVE-2024-24293 Original Reference from the National Vulnerability Database (NVD)
2. MiguelCastillo's GitHub Repository for @bit/loader

Exploit Details

To exploit this vulnerability, an attacker would need to craft a malicious input that can manipulate the properties of 'e' in the M function. Here's an example of a possible exploitation scenario:

// Attacker's crafted malicious input
const maliciousInput = {
  "__proto__": {
    "executeArbitraryCode": function() {
      console.log("Executing arbitrary code!");
      // Arbitrary code execution can go here
    }
  }
};

// Passing the malicious input as 'e' argument to the vulnerable M function
M(maliciousInput, {});

// Any newly created object will inherit the malicious property
const newObj = {};

// Arbitrary code execution in action
newObj.executeArbitraryCode();

The above example demonstrates the usage of a malicious input to manipulate an object's prototype. When the M function is executed with the malicious input, it affects the prototypes of other objects, allowing the attacker to execute arbitrary code using executeArbitraryCode function.

Conclusion

In conclusion, the Prototype Pollution vulnerability in @bit/loader v.10..3, identified as CVE-2024-24293, is a critical issue that can lead to arbitrary code execution. It's essential for developers and users of this library to understand the risk this vulnerability poses, and take necessary steps to mitigate the risk.

If you are using this library, it is highly recommended to follow the development closely and update to any patched versions as they become available. Always make sure to follow best practices in the secure development of your projects, and stay informed of any security updates and advisories related to the libraries and frameworks you use.

Timeline

Published on: 05/20/2024 18:15:10 UTC
Last modified on: 08/20/2024 14:35:04 UTC