Critical Flaw Discovered in Popular Protobuf Library Enables JavaScript Code Execution
Critical Flaw in Protobuf Library Enables JavaScript Code Execution
A recently discovered critical remote code execution flaw in protobuf.js, a widely-used JavaScript implementation of Google’s Protocol Buffers, has significant implications for server and application security.
The Vulnerability
The issue arises from the library’s failure to validate schema-derived identifiers, such as message names, which allows attackers to inject arbitrary code into generated functions.
Affected Versions
The vulnerable versions of protobuf.js include 8.0.0 and 7.5.4 and lower.
Mitigation
- Upgrade to patched versions, specifically 8.0.1 and 7.5.5, which sanitize type names by removing non-alphanumeric characters.
- Audit transitive dependencies.
- Treat schema-loading as untrusted input.
- Prefer precompiled/static schemas in production.
Additional Information
No active exploitation in the wild has been observed to date, but the ease of exploitation is underscored by the minimal proof-of-concept (PoC) code included in the security advisory.
The vulnerability was reported by Endor Labs researcher and security bug bounty hunter Cristian Staicu on March 2, and the maintainers released a patch on GitHub on March 11, followed by fixes to the npm packages on April 4 for the 8.x branch and April 15 for the 7.x branch.
About Author
English