Executive brief
CasperJS is a navigation and testing framework for headless browsers used to automate web testing and scraping tasks. The vulnerability allows attackers to pollute the Object prototype chain through the mergeObjects utility function, potentially modifying behavior of the application and other code running in the same JavaScript environment.
Technical details
This is a prototype pollution vulnerability in the mergeObjects utility function of CasperJS. The vulnerability exists because the function does not properly validate or sanitize object keys, allowing an attacker to inject properties into Object.prototype via the "__proto__" key. No authentication is required; the vulnerability is triggered when mergeObjects processes attacker-controlled JSON input. Successful exploitation allows modification of global object properties that can affect application logic and potentially lead to privilege escalation or denial of service. The package is no longer actively maintained as of June 2020.
Affected products
- CasperJS CasperJS through 1.1.4
Timeline
- 2020-06-19: disclosed
- 2021-05-17: advisory