Executive brief
total.js is a Node.js web framework library that provides utility functions for manipulating objects. A prototype pollution vulnerability in the set() function allows attackers to inject properties into object prototypes, potentially causing denial of service, property injection, or in some contexts remote code execution depending on how the application uses the affected function.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the total.js set() utility function that fails to properly sanitize path keys when setting values into objects. An attacker can craft a malicious path string containing prototype pollution sequences (such as "__proto__" or "constructor.prototype") to pollute the Object prototype. The attack requires network access and no authentication, but impact depends on the application's usage patterns. Versions before 3.4.7 are affected; the fix adds validation to reject paths that target prototype properties.
Affected products
- total.js total.js before 3.4.7
Timeline
- 2021-02-05: disclosed
- 2021-02-03: patched: Fixed in version 3.4.7