Executive brief
shvl is a JavaScript library used to get, set, and delete nested object properties. The library's set() function fails to validate input paths, allowing attackers to pollute the Object prototype by injecting properties like __proto__. This can lead to denial of service, privilege escalation, or remote code execution in applications that rely on object properties for security decisions.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the shvl library's set() function. The root cause is the absence of input validation on the path parameter before assigning properties to objects. An attacker can craft a path containing __proto__ (e.g., '__proto__.isAdmin') to modify the Object prototype shared across all instances in the application. The vulnerability requires only network reachability to a service using the vulnerable set() function with attacker-controlled input; no authentication is required. Successful exploitation can result in property spoofing, privilege escalation, or RCE depending on how the application uses polluted properties. The vulnerability affects versions 1.0.0 through 2.0.1 and was fixed in version 2.0.2.
Affected products
- shvl shvl 1.0.0 through 2.0.1
Timeline
- 2020-12-29: disclosed
- 2022-05-24: advisory