Executive brief
rdf-graph-array is a JavaScript library for manipulating RDF (Resource Description Framework) graphs. A vulnerability in the add method allows attackers to manipulate JavaScript object prototypes, potentially enabling them to modify core Object behavior and inject malicious properties that affect all objects in an application, leading to unexpected behavior or privilege escalation.
Technical details
rdf-graph-array versions through 0.3.0-rc6 are vulnerable to prototype pollution (CWE-400: Uncontrolled Resource Consumption) in the rdf.Graph.prototype.add method. The vulnerability allows manipulation of Object.prototype by crafting specially crafted input that tricks the method into adding or modifying properties on the prototype chain. The attack vector is network-based with no authentication required and no user interaction needed. Successful exploitation can result in integrity compromise (modification of object properties across the application), though confidentiality and availability are not directly impacted. No patch is available as the repository was archived in May 2019.
Affected products
- npm rdf-graph-array through 0.3.0-rc6
Timeline
- 2020-02-24: disclosed: NVD publication date
- 2021-04-13: advisory: GHSA advisory published