Executive brief
JointJS is a JavaScript library used for creating interactive diagram and visualization applications. A prototype pollution vulnerability in the util.setByPath function could allow attackers to manipulate the behavior of affected applications by modifying core JavaScript object properties, potentially leading to denial of service or application compromise.
Technical details
The vulnerability is a prototype pollution flaw in JointJS's util.setByPath function, where the path parameter used to access and set object keys is not properly sanitized. This allows an attacker to inject special keys like __proto__, constructor, or prototype to pollute the JavaScript prototype chain. The attack requires the ability to control input passed to util.setByPath, which may be reachable through application functionality that processes user-supplied data. Successful exploitation can modify global object properties, affecting all instances of affected objects and potentially causing denial of service or enabling further attacks. The vulnerability was fixed in version 3.3.0.
Affected products
- JointJS JointJS before 3.3.0
Timeline
- 2021-01-20: disclosed: Advisory published (GHSA-qwp9-52h8-xgg8)
- 3.3.0: patched: Fix released in version 3.3.0