Executive brief
DataTables is a popular JavaScript table manipulation library used by many web applications. A prototype pollution vulnerability allows attackers to modify JavaScript object prototypes, potentially enabling unauthorized access, data manipulation, or application hijacking. An initial patch was incomplete, leaving the vulnerability still exploitable through alternative attack vectors.
Technical details
The vulnerability is a Prototype Pollution flaw (CWE-1321) in the DataTables library, affecting how it processes object property assignments. An initial patch that blocked the `__proto__` property was incomplete—attackers could still trigger prototype pollution using the `constructor` property or other JavaScript internal mechanisms. The vulnerability is network-accessible and requires no authentication or user interaction, allowing remote attackers to pollute the global object prototype and inject malicious properties that affect all subsequent object operations.
Affected products
- DataTables DataTables < 1.10.22
Timeline
- 2020-12-16: disclosed: CVE-2020-28458 published on NVD
- 2020-12-17: advisory: GHSA-m7j4-fhg6-xf5v published
- 2020-12-17: patched: Fix released in version 1.10.22