{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/apostrophecms--4.30.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-53609"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ApostropheCMS (\u003c= 4.30.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ApostropheCMS"],"content_html":"\u003cp\u003eApostropheCMS versions up to and including 4.30.0 contain a critical server-side prototype pollution vulnerability within the \u003ccode\u003eapos.util.set()\u003c/code\u003e function. The flaw occurs because the function fails to sanitize properties such as \u003ccode\u003e__proto__\u003c/code\u003e, \u003ccode\u003econstructor\u003c/code\u003e, or \u003ccode\u003eprototype\u003c/code\u003e during path traversal. An authenticated user with editor-level privileges can exploit this by sending a crafted PATCH request utilizing the \u003ccode\u003e$pullAll\u003c/code\u003e operator to inject malicious properties into the global \u003ccode\u003eObject.prototype\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis pollution creates a persistent state within the Node.js process. Specifically, the gadget \u003ccode\u003epublicApiCheck()\u003c/code\u003e fails to correctly enforce authorization once \u003ccode\u003eObject.prototype.publicApiProjection\u003c/code\u003e is set, leading to a process-wide bypass for all REST API piece-type endpoints. This allows unauthenticated users to access sensitive data endpoints that would otherwise be restricted, with the effect persisting until the Node.js process is restarted.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid credentials for an editor-level account on the target ApostropheCMS instance.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the application to obtain a valid session token via the login API.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a PATCH request targeting a document, embedding the \u003ccode\u003e$pullAll\u003c/code\u003e operator in the request body.\u003c/li\u003e\n\u003cli\u003eThe payload uses dot-notation \u003ccode\u003e__proto__.publicApiProjection\u003c/code\u003e to trigger the unsafe \u003ccode\u003eapos.util.set()\u003c/code\u003e path traversal.\u003c/li\u003e\n\u003cli\u003eThe application backend processes the request and mutates the global \u003ccode\u003eObject.prototype\u003c/code\u003e, injecting \u003ccode\u003epublicApiProjection: []\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFuture requests from any user, including unauthenticated users, hit the application endpoints.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epublicApiCheck()\u003c/code\u003e logic evaluates the inherited (polluted) \u003ccode\u003epublicApiProjection\u003c/code\u003e property, causing the authorization check to skip.\u003c/li\u003e\n\u003cli\u003eUnauthenticated users retrieve sensitive data from protected REST API endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete, persistent authorization bypass for all REST API endpoints across the entire Node.js process. This affects multiple sensitive endpoints, including \u003ccode\u003e@apostrophecms/user\u003c/code\u003e and \u003ccode\u003e@apostrophecms/global\u003c/code\u003e. Because the pollution resides in the global prototype object, it remains effective for the lifetime of the process, impacting every visitor until a server restart occurs. This vulnerability is applicable in any multi-user deployment where editor-level accounts exist.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade ApostropheCMS immediately to a patched version that implements input validation in \u003ccode\u003eapos.util.set()\u003c/code\u003e and \u003ccode\u003eimplementPatchOperators()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy web server or WAF rules to inspect PATCH requests for \u003ccode\u003e__proto__\u003c/code\u003e, \u003ccode\u003econstructor\u003c/code\u003e, or \u003ccode\u003eprototype\u003c/code\u003e strings within the request body.\u003c/li\u003e\n\u003cli\u003eRestrict access to API endpoints to known safe IP ranges where possible to mitigate the impact of the bypass.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for anomalous PATCH requests containing prototype traversal patterns.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-01T01:47:31Z","date_published":"2026-08-01T01:47:31Z","id":"https://feed.craftedsignal.io/briefs/2026-08-apostrophe-prototype-pollution/","summary":"A server-side prototype pollution vulnerability in ApostropheCMS allows an authenticated editor to bypass authorization for all subsequent API requests by polluting Object.prototype via the $pullAll patch operator.","title":"ApostropheCMS Server-Side Prototype Pollution via apos.util.set","url":"https://feed.craftedsignal.io/briefs/2026-08-apostrophe-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - ApostropheCMS (\u003c= 4.30.0)","version":"https://jsonfeed.org/version/1.1"}