Executive brief
node-forge is a popular JavaScript cryptography library used in web applications and backend services to perform encryption, decryption, and cryptographic operations. A prototype pollution vulnerability in its util.setPath function allows attackers to manipulate JavaScript object prototypes, potentially leading to unauthorized code execution, data corruption, or application compromise without requiring authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw in the util.setPath function of node-forge versions prior to 0.10.0. This function fails to properly validate or sanitize property paths, allowing an attacker to inject properties into the prototype chain of JavaScript objects. The attack is network-accessible (AV:N) and requires no authentication or special conditions (PR:N, UI:N). An attacker can exploit this to poison object prototypes, affecting all objects that inherit from the polluted prototype, potentially enabling arbitrary property injection, DoS, or in some contexts, code execution. The vulnerability was fixed in version 0.10.0, which removed the vulnerable functions entirely as a breaking change.
Affected products
- node-forge node-forge before 0.10.0
Timeline
- 2020-09-14: disclosed
- 2020-09-14: patched: Fixed in version 0.10.0