Executive brief
libnested is a JavaScript library used to manage and manipulate deeply nested data structures. A security flaw in this library allows an attacker to inject malicious properties into the application's core objects. This can lead to the application crashing (denial of service) or, in some cases, allow the attacker to execute unauthorized code on the server.
Technical details
A prototype pollution vulnerability exists in libnested (versions 0.0.0 through 1.5.0) within its object manipulation functions, specifically the 'set' function. The root cause is the lack of validation when processing object paths, allowing an attacker to supply keys such as '__proto__'. By injecting properties into the global Object prototype, a remote attacker can manipulate application logic, cause a denial of service, or potentially achieve remote code execution (RCE) depending on how the library is integrated into the application. The vulnerability is reachable over the network without authentication if the application passes user-controlled input to affected libnested functions.
Affected products
- dominictarr libnested 0.0.0 - 1.5.0
Timeline
- 2020-12-29: disclosed: NVD publication date
- 2021-10-12: advisory: GitHub Advisory published