Critical protobuf.js vulnerability allows code execution

protobuf.js is a JavaScript runtime for Protocol Buffers, a serialisation format used to exchange information. The library is widely used in services built on Google Cloud, Firebase and other cloud platforms, and is popular in the npm registry. Researchers at Endor Labs have found a critical vulnerability rated CVSS 9.4 that allows arbitrary code execution through uploading a malicious configuration file to a target application. Upgrading to version 8.0.1 or 7.5.5 is strongly recommended.

What this means for your organisation

protobuf.js rarely registers with anyone, because it usually arrives as a dependency of a dependency. That is precisely why the question of whether you use it is hard to answer. The flaw is exploited through something the application accepts, so it affects services exposed to customers or partners. The case is a reminder that an inventory of software components is a precondition for acting quickly, not paperwork for the auditor.

Berigo recommends

• Search the dependency tree of every Node.js service for protobuf.js, including where it appears indirectly.
• Upgrade affected services to version 8.0.1 or 7.5.5.
• Maintain a live inventory of software components so the next case can be answered in hours rather than weeks.
• Add validation of files and configuration the application accepts from outside, regardless of this particular fix.

Source

• endorlabs.com
• bleepingcomputer.com