Executive brief
node-whois is a popular npm library for performing WHOIS domain lookups. The library is vulnerable to prototype pollution, a vulnerability that allows attackers to modify the behavior of all JavaScript objects in an application. An attacker can exploit this by sending a specially crafted input to the library, potentially leading to code execution, data theft, or application denial of service without authentication.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321, CWE-74, CWE-94) in the index.coffee file of node-whois where user-controlled data is improperly merged into JavaScript objects without sanitization. The attack requires only network access with no authentication or user interaction needed. An attacker can inject malicious properties into object prototypes to modify application behavior globally. The vulnerability affects all versions prior to 2.13.6, and a patch has been released in commit 46ccc2aee8d063c7b6b4dee2c2834113b7286076.
Affected products
- FurqanSoftware node-whois before 2.13.6
Timeline
- 2020-12-23: disclosed
- 2021-08-29: patched: Fix merged in PR #105
- 2022-12-19: advisory: Published to GitHub Advisory Database