Executive brief
getobject is a JavaScript utility library for reading and writing deeply nested object properties. A prototype pollution vulnerability in version 0.1.0 allows attackers to modify the Object prototype, leading to denial of service or potential remote code execution in applications using this library.
Technical details
The vulnerability is a prototype pollution weakness (CWE-1321) in the getobject library version 0.1.0 that allows an attacker to inject properties into the Object prototype. The vulnerable code is in lib/getobject.js around line 48. An attacker can craft malicious input to modify the prototype chain, affecting all object instances in the affected application. This can lead to denial of service through application crashes or, in some contexts, remote code execution. The vulnerability was fixed in version 1.0.0 released on 2021-11-03.
Affected products
- cowboy getobject 0.1.0 and all previous versions; fixed in 1.0.0
Timeline
- 2020-12-29: disclosed: CVE-2020-28282 published to NVD
- 2021-10-12: advisory: GHSA-957j-59c2-j692 published
- 2021-11-03: patched: Version 1.0.0 released with fix for CVE-2020-28282