Full Report
Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js, a widely used JavaScript implementation of Google's Protocol Buffers. [...]
Analysis Summary
# Vulnerability: Critical RCE in protobuf.js via Unsafe Dynamic Code Generation
## CVE Details
- **CVE ID**: N/A (Currently tracked as **GHSA-xq3m-2v4x-88gg**)
- **CVSS Score**: Not officially assigned (Classified as **Critical**)
- **CWE**: CWE-94: Improper Control of Generation of Code ('Code Injection') / CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
## Affected Systems
- **Products**: `protobuf.js` (JavaScript implementation of Google Protocol Buffers)
- **Versions**:
- Version 8.0.0 and lower
- Version 7.5.4 and lower
- **Configurations**: Applications that process attacker-influenced or untrusted protobuf schemas, or environments where schemas are dynamically loaded and decoded.
## Vulnerability Description
The vulnerability stems from the library's use of the `Function()` constructor to dynamically generate JavaScript functions from protobuf schemas. The library creates these functions by concatenating strings based on schema-derived identifiers (such as message or type names). Because the library failed to properly validate or sanitize these identifiers, an attacker can craft a malicious schema containing specifically formatted strings. When the library processes this schema, it injects the attacker's arbitrary code into the synthetic function, leading to Remote Code Execution (RCE).
## Exploitation
- **Status**: PoC available (Published in the GitHub Security Advisory); No active exploitation in the wild observed to date.
- **Complexity**: Low
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Access to environment variables, credentials, and databases)
- **Integrity**: High (Ability to execute arbitrary code and modify system state)
- **Availability**: High (Potential for system takeover or service disruption)
## Remediation
### Patches
The maintainers have released updates to sanitize type names by stripping non-alphanumeric characters.
- **8.x Branch**: Upgrade to version **8.0.1** (Released April 4)
- **7.x Branch**: Upgrade to version **7.5.5** (Released April 15)
### Workarounds
- **Treat Schemas as Untrusted**: Do not load or process protobuf definitions from external or unverified sources.
- **Static Compilation**: Use precompiled/static schemas in production environments instead of dynamic loading to avoid the use of the `Function()` constructor at runtime.
- **Dependency Auditing**: Use tools like `npm audit` or `snyk` to identify transitive dependencies that may be pulling in vulnerable versions of `protobuf.js`.
## Detection
- **Indicators of Compromise**: Presence of unexpected alphanumeric/special character sequences in `.proto` files or schema definitions being sent to the application.
- **Detection Methods**:
- Scan for vulnerable versions of `protobuf.js` in `package-lock.json` or `node_modules`.
- Monitor for unusual child process spawns or unexpected outbound network connections from Node.js applications processing schemas.
## References
- **GitHub Security Advisory**: hxxps[://]github[.]com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- **Endor Labs Technical Analysis**: hxxps[://]www[.]endorlabs[.]com/learn/the-dangers-of-reusing-protobuf-definitions-critical-code-execution-in-protobuf-js-ghsa-xq3m-2v4x-88gg
- **NPM Package**: hxxps[://]www[.]npmjs[.]com/package/protobufjs