Executive brief
jsii is a TypeScript-to-JavaScript compiler and code generator library used by developers to build cross-language tools. When loaded as a library and given untrusted input, a developer can inadvertently pollute the JavaScript Object prototype, causing unexpected fields to appear on all objects in the consuming application. While the impact is limited to applications that explicitly load jsii as a library and pass user-controlled data to its configuration functions, a successful exploit could alter program logic and create security issues in dependent applications.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the jsii.configureCategories() function. The vulnerability occurs when untrusted input containing a `__proto__` property is passed to configureCategories(), allowing an attacker to inject arbitrary properties into the JavaScript Object prototype. The attack requires the vulnerable application to load jsii as a library and pass unsanitized user input directly to the affected function; the CLI tool is not affected. An attacker exploiting this can pollute the global object prototype, causing every object instance in the consuming application to inherit the injected property, potentially altering conditional logic and program behavior. Patches are available in versions 5.4.46, 5.5.15, 5.6.4, and 5.7.3; affected versions span 5.4.0–5.4.45, 5.5.0–5.5.14, 5.6.0–5.6.3, and 5.7.0–5.7.2.
Affected products
- AWS jsii 5.4.0 to 5.4.45, 5.5.0 to 5.5.14, 5.6.0 to 5.6.3, 5.7.0 to 5.7.2
Timeline
- 2024-12-18: disclosed
- 2024-12-18: patched: Patches available in versions 5.4.46, 5.5.15, 5.6.4, and 5.7.3