Executive brief
The set-object-value npm library is a utility used in JavaScript/Node.js applications to set nested object properties. A prototype pollution vulnerability allows attackers to inject malicious code into the base prototype of all objects, potentially leading to denial of service or remote code execution in any application using this library. Organizations using this package in production must upgrade immediately to version 0.0.6 or later to prevent exploitation.
Technical details
This prototype pollution vulnerability (CWE-1321) exists in the set-object-value npm package versions 0.0.0 through 0.0.5. The replaceValue function iterates through an array of keys and sets nested properties on an object without validating whether the key is a sensitive property like "__proto__", "constructor", or "prototype". An attacker can supply specially crafted object keys to modify the prototype chain of all JavaScript objects in the application, leading to denial of service (causing the application to crash or behave unpredictably) or potentially remote code execution if the polluted prototype includes executable code. The vulnerability requires network access to any application using the affected package and no authentication, with attack success depending on how the application uses the library. The fix is available in version 0.0.6 and later.
Affected products
- react-atomic set-object-value 0.0.0 through 0.0.5
Timeline
- 2020-12-29: disclosed
- 2021-04-13: advisory
- 0.0.6: patched: Fix version 0.0.6 available