Executive brief
node-oojs is a JavaScript Object Oriented library commonly used in Node.js applications. This vulnerability allows an attacker to inject malicious properties into JavaScript object prototypes, potentially causing application crashes, property injection attacks, or in some cases remote code execution. Applications using node-oojs versions up to 1.4.0 are at risk with no available patch.
Technical details
This is a prototype pollution vulnerability in the setPath function of node-oojs affecting all versions up to and including 1.4.0. The vulnerability occurs via property definition by path, where an attacker can supply a malicious path string containing __proto__ to inject properties into Object.prototype. The attack is triggered by calling setPath() with a specially crafted object path (e.g., '__proto__.polluted'), which pollutes the base Object prototype. No authentication or user interaction is required; any code that accepts untrusted input and passes it to setPath is vulnerable. Exploitation can lead to denial of service (application crashes), property injection (privilege escalation via corrupted attributes), or remote code execution if the application evaluates prototype-polluted properties. No patched version is currently available for node-oojs.
Affected products
- node-oojs node-oojs up to and including 1.4.0
Timeline
- 2020-08-14: disclosed
- 2021-05-06: advisory