Executive brief
Dojo is a popular JavaScript framework used to build web applications. The framework contains a vulnerability in its deepCopy utility function that allows attackers to inject arbitrary properties into JavaScript object prototypes, potentially corrupting application state or enabling code execution on affected pages.
Technical details
The vulnerability is a prototype pollution flaw in the dojo/request/util/deepCopy and dojo/mixin modules. The deepCopy method fails to properly sanitize property names during deep object copying, allowing attackers to inject properties into Object.prototype via special keys like __proto__. An attacker can craft a malicious JSON payload that, when passed to deepCopy, pollutes the base object prototype. This requires the attacker to control input passed to the deepCopy function. The vulnerability has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2.
Affected products
- Dojo dojo <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1
Timeline
- 2020-03-10: disclosed: Advisory published
- 2020-03-10: patched: Patches released in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2