Executive brief
bmoor is a JavaScript utility library used as a foundation for other projects. The library contains a prototype pollution vulnerability in its set function that allows attackers to modify JavaScript object prototypes, potentially affecting all code using the library and leading to unexpected behavior, denial of service, or further exploitation.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the set function of bmoor versions before 0.8.12. An attacker can inject malicious properties into JavaScript object prototypes via specially crafted input to the set function, which does not properly validate or sanitize property names. This is a network-reachable vulnerability with no authentication required if the vulnerable library is exposed through a web interface. The attack allows an attacker to poison the prototype chain, potentially enabling arbitrary code execution, denial of service, or privilege escalation depending on how the application uses the affected library. A patch was released in version 0.8.12 on 2020-09-17.
Affected products
- bmoor bmoor before 0.8.12
Timeline
- 2020-10-02: disclosed
- 2020-09-17: patched
- 2021-05-10: advisory