Executive brief
undefsafe is a utility library used by developers to safely access or set deeply nested data within JavaScript objects. A vulnerability in this library allows an attacker to inject or modify global object properties. In practice, this can lead to application crashes, unauthorized data modification, or potentially more severe security bypasses depending on how the application uses the library.
Technical details
The undefsafe package before version 2.0.3 is vulnerable to Prototype Pollution. The 'a' function (the primary export) does not properly sanitize property keys, allowing an attacker to use the '__proto__' property to add or modify properties on the global Object.prototype. This is reachable if an attacker can control the path or value arguments passed to the function. Successful exploitation can lead to a Denial of Service (DoS) by overriding built-in methods or potentially remote code execution if the polluted properties are later used in a sensitive context. The issue was fixed in version 2.0.3 by verifying that properties exist on the object itself before assignment.
Affected products
- remy undefsafe < 2.0.3
Timeline
- 2019-12-15: disclosed: Vulnerability disclosed by Snyk/JHU System Security Lab
- 2020-02-18: advisory: NVD and Snyk published advisories
- 2020-02-18: patched: Version 2.0.3 released with fix