Executive brief
js-data is a popular data store library for JavaScript applications. A prototype pollution vulnerability in the deepFillIn function allows attackers to inject malicious properties into the base JavaScript Object prototype, potentially compromising all objects in the application and enabling remote code execution or denial of service attacks.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deepFillIn function of js-data versions prior to 3.0.10. An attacker can craft malicious input containing magical JavaScript properties (__proto__, constructor, prototype) to pollute the Object.prototype, causing all JavaScript objects in the application to inherit the attacker's injected properties. The attack is network-reachable if the application processes untrusted JSON data. The fix validates input to detect and reject these magical property names, preventing prototype pollution. The vulnerability affects all versions prior to 3.0.10, with a patch available in version 3.0.10 and later.
Affected products
- js-data js-data <3.0.10
Timeline
- 2020-12-15: disclosed: NVD publication date
- 2021-03-19: patched: Security fix merged in PR #574
- 2022-02-09: advisory: GHSA published