Executive brief
connie-lang is a configuration language library for JavaScript applications. The package contains a prototype pollution vulnerability that allows attackers to modify properties on JavaScript object prototypes, potentially compromising the integrity and behavior of applications using this library.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-915) in the connie-lang configuration language library prior to version 0.1.1. The vulnerability allows attackers to pollute JavaScript object prototypes by injecting malicious properties through the configuration parsing mechanism. This is a network-reachable vulnerability requiring no authentication or user interaction. Successful exploitation can enable arbitrary property injection affecting all objects in an application, potentially leading to denial of service, privilege escalation, or code execution depending on how the application uses object properties. The fix was applied in version 0.1.1 as evidenced by security test commits on 2020-08-17.
Affected products
- connie-lang connie-lang <0.1.1
Timeline
- 2020-08-18: disclosed
- 2020-08-17: patched: Version 0.1.1 released with security fixes