Executive brief
Deap is a JavaScript utility library used for deep object manipulation and cloning. A flaw in its utilities function allows attackers who control input data to inject properties into the JavaScript Object prototype, affecting all objects in the application. This can lead to unauthorized property modification, data corruption, or code execution depending on how affected properties are used.
Technical details
The vulnerability is a prototype pollution flaw in the utilities function of the deap Node.js module. When an attacker can control part of the data structure passed to this function (e.g., via JSON input, query parameters, or other untrusted sources), they can inject properties into the Object prototype using special keys like "__proto__" or "constructor.prototype". This allows the attacker to add or modify properties that will exist on all JavaScript objects in the application, potentially leading to property overwrites, authentication bypass, or remote code execution depending on how the affected properties are used. The vulnerability affects all versions prior to 1.0.1, which introduced prototype contamination protections. No authentication or user interaction is required; the attack only requires network-reachable input validation.
Affected products
- npm deap < 1.0.1
Timeline
- 2022-05-14: disclosed
- 1.0.1: patched