Executive brief
deepref is a popular npm library that allows developers to write values to deeply nested fields in JavaScript objects using string references (e.g., "object.subfield"). A prototype pollution vulnerability in versions 1.1.1 through 1.2.1 allows attackers to manipulate the JavaScript object prototype, potentially causing denial of service or remote code execution in applications that depend on this library.
Technical details
This is a prototype pollution vulnerability in the deepref npm library (versions 1.1.1–1.2.1) that arises from insufficient input validation when processing nested field paths. The vulnerability allows an attacker to pollute the Object.prototype by supplying specially crafted path strings (such as "__proto__" or "constructor.prototype"), enabling modification of properties inherited by all JavaScript objects. An attacker can exploit this through network vectors if the affected application exposes deepref functionality to untrusted input (no authentication required). Successful exploitation can lead to denial of service through object corruption or remote code execution depending on how the polluted prototype properties are subsequently used. A fix is available in the repository commit 24935e6a1060cb09c641d3075982f0b44cfca4c2.
Affected products
- npm deepref 1.1.1 through 1.2.1
Timeline
- 2020-12-08: disclosed
- 2021-10-12: advisory