Executive brief
immer is a widely-used JavaScript library for immutable state management in web applications. A prototype pollution vulnerability allows attackers to inject properties into JavaScript's Object prototype, potentially affecting all objects in the application and leading to denial of service, property manipulation, or privilege escalation depending on how the affected application uses the prototype chain.
Technical details
The vulnerability is a prototype pollution flaw (CWE-471) in the applyPatches function of immer, introduced in version 7.0.0. The root cause is insufficient validation of the patch operation path, allowing an attacker to specify paths like ["__proto__", "polluted"] which modify the Object prototype. The attack requires the application to call applyPatches with untrusted patch data; no authentication or user interaction is needed if patches come from an untrusted source (e.g., API response, user input). This can result in denial of service, object property injection, or logic bypasses. Version 8.0.1 and later contain a fix that sanitizes prototype-pollution-dangerous paths.
Affected products
- immerjs immer 7.0.0 to before 8.0.1
Timeline
- 2021-01-19: disclosed: Vulnerability reported to immerjs
- 2021-01-20: patched: Fix released in version 8.0.1
- 2021-01-20: advisory: GitHub Security Advisory GHSA-9qmh-276g-x5pj published