Executive brief
hoek is a popular Node.js utility library used across many JavaScript applications for object manipulation and validation. Versions prior to 4.2.1 and 5.0.3 contain a prototype pollution vulnerability that allows attackers to inject malicious properties into JavaScript objects, potentially modifying application behavior, corrupting data, or causing denial of service.
Technical details
Prototype pollution in the merge, applyToDefaults, and applyToDefaultsWithShallow functions allows an attacker to inject arbitrary properties into the Object prototype when processing untrusted JSON payloads containing the __proto__ key. The vulnerability is triggered when these functions process JSON-parsed data without sanitizing prototype-related keys. No authentication or special preconditions are required; the attack succeeds when the application calls one of the vulnerable functions with attacker-controlled JSON data. Successful exploitation can lead to denial of service or property overwrites affecting all objects. Patches are available in versions 4.2.1, 5.0.3, and later, which filter out __proto__ assignments.
Affected products
- npm hoek Prior to 4.2.1 and 5.0.0 through 5.0.2
Timeline
- 2018-04-26: disclosed
- 2018-04-26: patched: Fixed in versions 4.2.1 and 5.0.3