Executive brief
fun-map is a lightweight JavaScript utility library for object manipulation used in Node.js applications. The library contains a prototype pollution vulnerability that allows an attacker to modify the Object.prototype through specially crafted input, potentially affecting all objects in the application and leading to code execution or data manipulation.
Technical details
fun-map versions through 3.3.1 are vulnerable to prototype pollution via the assocInM function. The vulnerability occurs because the function does not properly validate or filter keys, allowing an attacker to inject the __proto__ key to modify Object.prototype. The attack requires no authentication or user interaction—an attacker with network access to an application using the vulnerable library can supply a malicious payload in object keys. Successful exploitation allows arbitrary property modification on Object.prototype, which can be leveraged for denial of service, authentication bypass, or remote code execution depending on how the affected application uses object properties. No patch version information is currently available in the advisory.
Affected products
- npm fun-map through 3.3.1
Timeline
- 2020-04-28: disclosed
- 2021-12-10: advisory
- 2021-05-25: other: GitHub reviewed