Executive brief
The PayPal Adaptive Payments Node.js SDK is vulnerable to prototype pollution, a JavaScript manipulation attack that allows an attacker to modify core object properties shared across an application. An authenticated attacker could exploit this to alter application behavior, bypass security checks, or cause a denial of service, potentially affecting integrations that process PayPal payments.
Technical details
The paypal-adaptive Node.js library through version 0.4.2 is vulnerable to prototype pollution via a __proto__ payload in function parameters. The vulnerability exists in the PayPal function's object manipulation logic (lib/paypal-adaptive.js line 31) where untrusted input is processed without proper sanitization. An authenticated attacker with network access can craft malicious payloads to add or modify properties on Object.prototype, affecting all objects in the running application. The attack requires prior authentication (PR:L) and has partial impact on both integrity and availability, though no confidentiality impact. A patch or upgrade to a version beyond 0.4.2 is required to remediate this issue.
Affected products
- PayPal paypal-adaptive through 0.4.2
Timeline
- 2021-12-10: disclosed
- 2020-04-23: other: NVD publication date