Executive brief
copy-props is a Node.js utility library for copying properties between objects. A prototype pollution vulnerability in versions before 2.0.5 allows an attacker to inject malicious properties into the JavaScript Object prototype, potentially affecting any code running in the same process. This could lead to unexpected behavior, data corruption, or application crashes.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the main functionality of copy-props that allows attackers to pollute the Object prototype by crafting malicious input objects. The attack is network-reachable if the application processes untrusted input via copy-props without validation. An attacker can inject arbitrary properties into the Object prototype, affecting all downstream code. The vulnerability was fixed in version 2.0.5 via a PR that explicitly checks and prevents pollution of the __proto__ property and other dangerous keys during the copy operation.
Affected products
- gulpjs copy-props before 2.0.5
Timeline
- 2021-03-23: disclosed: CVE-2020-28503 published on NVD
- 2021-03-18: patched: Fix merged in PR #7
- 2022-01-06: advisory: GHSA-897m-rjf5-jp39 published