Executive Summary

This vulnerability exists in ApostropheCMS, an open-source Node.js content management system, in versions up to and including 4.30.0. The issue arises because the function apos.util.set() traverses dot-notation paths without sanitizing the __proto__ property. This allows an authenticated editor to write arbitrary values to Object.prototype using the $pullAll patch operator.

A confirmed gadget in the publicApiCheck() function causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.

No patched versions are known to be available at the time of publication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an authenticated editor to modify the Object.prototype, which can lead to unauthorized access.

Due to the bypass of authorization in the publicApiCheck() function, any subsequent unauthenticated requests can access all piece-type REST API endpoints without restriction for the lifetime of the Node.js process.

This can lead to a complete compromise of the application's data confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

As of the time of publication, no known patched versions of ApostropheCMS are available to fix this vulnerability.

Immediate mitigation steps include restricting access to authenticated editor accounts to trusted users only, monitoring and limiting unauthenticated REST API requests, and considering temporary disabling or restricting piece-type REST API endpoints if possible.

Additionally, closely monitor official ApostropheCMS channels for any forthcoming patches or updates addressing this issue.

Useful 0 Not Useful 0