Executive brief
utilitify is a JavaScript utility library used in applications for object manipulation and merging. This vulnerability allows attackers with application access to modify core Object.prototype properties, potentially affecting all objects in the application and leading to data manipulation, unauthorized access, or denial of service.
Technical details
utilitify versions prior to 1.0.3 are vulnerable to prototype pollution, a type of improperly controlled modification of dynamically-determined object attributes (CWE-1321, CWE-915). The merge method fails to safely validate input, allowing an attacker to craft malicious objects that, when merged, pollute the Object.prototype with arbitrary properties. This requires authentication or direct access to the merge function. An attacker can inject properties into the base object prototype, affecting subsequent object operations across the entire application. The vulnerability has been patched in version 1.0.3.
Affected products
- utilitify utilitify before 1.0.3
Timeline
- 2021-05-07: disclosed
- 2021-05-07: patched: Fixed in version 1.0.3