Junglewise Threat Intelligence

CVE-2019-10747: set-value prototype pollution

CVE-2019-10747 · Severity: low · CVSS 3.1 · Published 2019-08-27

Executive brief

set-value is a Node.js library used to set nested object properties using dot-notation paths. The library contains a prototype pollution vulnerability that allows attackers to inject malicious properties into all JavaScript objects in a running application. This could lead to data corruption, application logic bypass, or code execution depending on how the affected application uses object properties.

Technical details

The set-value library fails to validate which Object properties it updates when processing dot-notation path strings. An attacker can exploit this by passing paths like 'constructor.prototype.foo' or '__proto__.bar' to the set function, allowing modification of Object.prototype itself. The vulnerability is triggered remotely when untrusted user input is passed to set-value without validation. The fix involves filtering out dangerous property keys (constructor, prototype, __proto__) during path parsing. Versions 2.0.1, 3.0.1, and later contain patches that disallow these special keys.

Affected products

  • jonschlinkert set-value <2.0.1, >=3.0.0 <3.0.1

Timeline

  • 2019-06-19: disclosed
  • 2019-06-19: patched: Fixes committed for both 2.x and 3.x branches
  • 2019-08-27: advisory

References