Executive brief
nodee-utils is a JavaScript utility library used in Node.js applications. A prototype pollution vulnerability in the deepSet function allows an attacker to modify object prototypes, potentially enabling remote code execution or unauthorized modification of application behavior on any system using an affected version.
Technical details
The deepSet function in nodee-utils versions below 1.2.3 is vulnerable to prototype pollution (CWE-1321), a class of vulnerability where untrusted input is used to set properties on JavaScript objects without proper sanitization. An attacker can exploit this to pollute the Object prototype, affecting all objects in the application. The vulnerability is network-accessible, requires no authentication, and no user interaction. Successful exploitation allows an attacker to achieve code execution or manipulate application logic. A fix is available in version 1.2.3 and later.
Affected products
- nodee-apps nodee-utils <1.2.3
Timeline
- 2020-09-01: disclosed
- 2021-05-05: patched
- 2021-05-06: advisory