Executive brief
just-extend is a JavaScript utility library used by developers to merge or extend objects. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript's base Object prototype, causing those properties to appear on all objects application-wide. This can lead to code execution, data tampering, or authentication bypass depending on how the application uses object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in just-extend versions before 4.0.0, where specially crafted input to the library's extend function can modify the Object prototype. The attack requires no authentication or user interaction and is network-reachable in any application that processes untrusted JSON or object data through just-extend. An attacker can inject arbitrary properties into the prototype, which then exist on all objects in the application, potentially enabling remote code execution, authentication bypass, or other injection attacks. The fix is available in version 4.0.0 and later.
Affected products
- just-extend just-extend before 4.0.0
Timeline
- 2019-02-07: disclosed
- 2018: patched: CVE-2018-16489 indicates discovery in 2018; version 4.0.0 fix available