Executive brief
Supermixer is a JavaScript library used to merge object properties in application code. A prototype pollution vulnerability allows an attacker to inject malicious properties into JavaScript object prototypes, potentially leading to denial of service, unauthorized data access, or remote code execution depending on how the application uses the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the supermixer merge function that fails to sanitize user-supplied input when merging objects. An attacker can craft a malicious JSON payload containing __proto__ properties to pollute the prototype chain of base objects. The attack is network-reachable if the application processes untrusted input through the supermixer merge function without validation. Successful exploitation can result in modification of behavior across all objects in the application, enabling DoS, data theft, or RCE depending on implementation context. The vulnerability affects all versions prior to 1.0.5, which includes the fix.
Affected products
- Stampit supermixer before 1.0.5
Timeline
- 2020-08-20: disclosed
- 2021-06-16: patched: Fixed in version 1.0.5