Executive brief
The keyget npm library is a utility for accessing and setting nested object properties. A prototype pollution vulnerability in versions 1.0.0 through 2.2.0 allows attackers to manipulate JavaScript object prototypes without authentication, potentially causing application crashes or enabling remote code execution by poisoning shared object properties that other code relies on.
Technical details
The vulnerability is a prototype pollution flaw in the setByPath() function, which accepts a target object, a path string, and a value but fails to validate whether the path references __proto__ or other sensitive prototype chain properties. An attacker can craft a malicious path parameter (e.g., '__proto__.polluted') to inject arbitrary properties into Object.prototype, affecting all objects in the application. The attack requires network access if keyget is used in a web service, but no authentication or user interaction is needed. This can lead to denial of service through property overwrites or remote code execution if polluted properties are later used in dangerous contexts. The vulnerability was patched in version 2.3.0 (released 2020-11-22).
Affected products
- rumkin keyget 1.0.0 through 2.2.0
Timeline
- 2020-12-02: disclosed: NVD publication date
- 2020-11-22: patched: Fixed in version 2.3.0
- 2022-05-24: advisory: GHSA published