Executive brief
hoek is a popular utility library used by Node.js applications for object manipulation and validation. A flaw in the clone() function allows attackers to inject properties into the prototype chain if they can pass a specially crafted object with a "__proto__" key to the function. This prototype pollution could enable unauthorized modification of application behavior or object properties across the entire system.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the clone() function of hoek versions prior to 8.5.1 and 9.x prior to 9.0.3. When an object containing a "__proto__" key is passed to clone(), the key is incorrectly converted to a prototype property instead of being cloned as a normal object key. Exploitation requires an attacker to inject a malicious object into a code path where clone() is called on untrusted input; in hapi applications, the framework's input validation typically prevents such objects from reaching clone(). The patch, available in versions 8.5.1 and 9.0.3, properly handles the "__proto__" key as a regular property during cloning.
Affected products
- hapi hoek prior to 8.5.1; 9.x prior to 9.0.3
- hapi @hapi/hoek prior to 8.5.1; 9.x prior to 9.0.3
Timeline
- 2020-02-08: disclosed: Issue #352 opened in hapijs/hoek repository
- 2022-09-23: advisory: NVD published CVE-2020-36604
- 2022-09-25: advisory: GitHub advisory GHSA-c429-5p7v-vgjp published
- 2022-09-25: patched: Patch available in versions 8.5.1 and 9.0.3