Executive brief
express-mock-middleware is a Node.js package used to mock HTTP endpoints in Express applications. The package is vulnerable to prototype pollution, which allows an attacker to modify properties on all JavaScript objects application-wide. An attacker would need to create a malicious file in a specific directory that the application loads, potentially compromising application behavior and data integrity.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321, CWE-915) in express-mock-middleware versions through 0.0.6. The package dynamically loads and processes JavaScript files from a configurable glob pattern (default: mock/**/*.js), using Object.extend or similar mechanisms to merge exported objects without proper validation. This allows an attacker to craft a malicious JavaScript file with __proto__ or constructor.prototype properties that pollute Object.prototype. Exploitation requires the attacker to create a new file within the watch directory that gets loaded and processed by the middleware. The vulnerability is network-adjacent or requires local file system access, making it lower risk in most deployment scenarios. No patch information is currently available in the advisory.
Affected products
- LingyuCoder express-mock-middleware through 0.0.6
Timeline
- 2020-04-07: disclosed
- 2021-12-09: advisory