Executive brief
object-hierarchy-access is a JavaScript library for accessing and manipulating nested object properties. A prototype pollution vulnerability allows attackers to modify the Object.prototype, potentially causing denial of service or remote code execution in applications that use this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in object-hierarchy-access versions 0.2.0 through 0.32.0. The library fails to prevent assignment to the `__proto__` property when setting values on objects, allowing an attacker to pollute Object.prototype. This can be exploited via network requests (no authentication required) to inject malicious properties that affect all objects in the JavaScript runtime. An attacker can achieve denial of service through resource exhaustion or, in some contexts, remote code execution. The fix was released in version 0.33.0, which explicitly blocks assignment to `__proto__`.
Affected products
- mjpclab object-hierarchy-access 0.2.0 through 0.32.0
Timeline
- 2020-11-12: disclosed: CVE-2020-28270 published on NVD
- 2020-11-07: patched: Fix committed (version 0.33.0)
- 2021-10-12: advisory: GHSA advisory published