Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-36665
CVE-2023-36665:
JavaScript vulnerability analysis and mitigation
Overview
CVE-2023-36665 affects protobuf.js versions 6.10.0 through 7.x before 7.2.5. This vulnerability allows Prototype Pollution, which is distinct from CVE-2022-25878. The issue was discovered in July 2023 and affects the protobuf.js library, a popular JavaScript implementation of Protocol Buffers (NVD).
Technical details
The vulnerability allows an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions through multiple attack vectors: (1) using the parse function to parse protobuf messages on the fly, (2) loading .proto files via load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. The vulnerability has received a CVSS v3.1 Base Score of 9.8 CRITICAL (Code Intelligence).
Impact
Successful exploitation of this vulnerability can lead to several severe consequences including remote code execution (RCE), denial of service (DoS) by overriding built-in functions, authentication/validation bypass, privilege escalation, and cross-site scripting (XSS). The vulnerability affects all objects created after the prototype pollution occurs (Code Intelligence).
Mitigation and workarounds
The vulnerability has been fixed in version 7.2.5. Users are strongly recommended to upgrade to this version or later to address the security issue. The fix prevents the setProperty function from modifying the prototype by adding checks for 'proto' and 'prototype' attributes (GitHub Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management