Executive brief
Locutus is a JavaScript library that provides PHP-compatible string and array manipulation functions for JavaScript developers. A prototype pollution vulnerability in the parse_str function allows attackers to inject arbitrary properties into JavaScript objects, potentially leading to code execution or application malfunction depending on how the application uses the affected library.
Technical details
Locutus versions prior to 2.0.12 are vulnerable to prototype pollution via the php.strings.parse_str function. The vulnerability occurs when processing untrusted input that is parsed as URL-encoded query strings, allowing an attacker to inject malicious property names (e.g., __proto__, constructor) that modify the Object prototype. This is a CWE-1321 / CWE-915 vulnerability requiring only network access and no authentication. An attacker can poison the prototype chain to affect all objects in the application's runtime, potentially leading to privilege escalation, code execution, or denial of service. The vulnerability was patched in version 2.0.12, available via pull request #418.
Affected products
- locutus locutus all versions prior to 2.0.12
Timeline
- 2020-09-01: disclosed
- 2020-09-03: patched: Security fix merged in PR #418
- 2021-05-06: advisory: GHSA advisory published