Executive brief
worksmith is a JavaScript workflow engine library used in Node.js applications. A prototype pollution vulnerability in the setValue function allows attackers to inject malicious properties into JavaScript object prototypes, potentially causing application crashes or enabling remote code execution if the application evaluates user-controlled object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the setValue function of worksmith affecting all versions up to and including 1.0.0. The function does not properly validate the property path parameter, allowing an attacker to set __proto__ or constructor properties, which pollutes the Object.prototype and affects all JavaScript objects in the application. The attack vector is network/local (depending on how the library is exposed), requires no authentication or user interaction, and can lead to denial of service via prototype pollution or remote code execution if the application evaluates polluted properties. No patched version exists; the package appears to be unmaintained.
Affected products
- worksmith worksmith up to and including 1.0.0
Timeline
- 2020-08-17: disclosed
- 2020-09-01: advisory
- 2021-05-06: other: GHSA published