Executive brief
promisehelpers is a JavaScript library providing Promise utility functions. A prototype pollution vulnerability in its insert function allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to application crashes, privilege escalation, or remote code execution depending on how the application uses polluted object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the insert function of promisehelpers versions up to 0.0.5. The insert function allows an attacker to define properties on Object.prototype by crafting a path containing __proto__ (e.g., ['__proto__', 'polluted']). No authentication or user interaction is required; the attack is triggered via network calls to applications using the vulnerable library. Successful exploitation can cause denial of service via unexpected property mutations, enable privilege escalation by polluting security-related properties (e.g., isAdmin), or in rare cases allow remote code execution if the application evaluates polluted properties. The fix is to upgrade to version 0.0.6 or later.
Affected products
- promisehelpers promisehelpers 0.0.5 and earlier
Timeline
- 2020-08-14: disclosed
- 2020-09-01: advisory
- 2020: patched: Fix available in version 0.0.6