Executive brief
The 'flat' library, a popular utility for flattening and unflattening JavaScript objects, contains a security vulnerability that could allow an attacker to manipulate application logic. By providing specially crafted input, an attacker can modify the base structure of JavaScript objects (the prototype), potentially leading to unauthorized data access or service disruption. This issue affects various versions of the library and can be exploited remotely if the application processes untrusted user input through the affected function.
Technical details
A prototype pollution vulnerability exists in the 'unflatten' function within index.js of the 'flat' library (npm package 'flat'). The vulnerability stems from improper validation of keys such as '__proto__' during the unflattening process, allowing an attacker to inject properties into the global Object prototype. This can be exploited remotely without authentication if an application passes untrusted JSON or object data to the unflatten() method. Successful exploitation can lead to various impacts including denial of service, bypass of security checks, or in some environments, remote code execution. The issue is addressed in versions 1.6.2, 2.0.2, 3.0.1, 4.1.2, and 5.0.2.
Affected products
- hughsk flat < 1.6.2, 2.0.0 - 2.0.1, 3.0.0, 4.0.0 - 4.0.1, 5.0.0
Timeline
- 2020-07-18: disclosed: Issue reported on GitHub
- 2020-08-06: patched: Fixes merged and backported to multiple major versions
- 2022-12-25: advisory: NVD and GitHub Advisory published