Executive brief
flattenizer is a JavaScript library used to flatten and unflatten nested objects. A prototype pollution vulnerability in the unflatten() function allows attackers to inject arbitrary properties into JavaScript objects, potentially causing denial of service or remote code execution in applications that use this library to process untrusted data.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the unflatten() function of flattenizer versions 0.0.5 through 1.0.5. The function does not validate input or check whether assigned properties are the object's own properties before assigning values, allowing an attacker to pollute the Object prototype by crafting input with __proto__ properties. An attacker can call unflatten() with specially crafted payloads (e.g., unflatten({'__proto__.polluted': true})) without requiring authentication or user interaction. This causes arbitrary prototype pollution, which can lead to denial of service (DoS) or remote code execution depending on how the application uses the polluted properties. The vulnerability was patched in version 1.1.1; applications should upgrade immediately.
Affected products
- flattenizer flattenizer 0.0.5 through 1.0.5
Timeline
- 2020-12-29: disclosed: CVE-2020-28279 published
- 2020-12-28: patched: Fix merged in pull request #13; version 1.1.1 contains the fix