Executive brief
safetydance is a Node.js library that provides safe exception handling for synchronous functions. The library's set function is vulnerable to prototype pollution, allowing an attacker to modify the JavaScript object prototype and potentially inject malicious properties into all objects in the application, leading to unexpected behavior or security bypasses.
Technical details
The vulnerability is a prototype pollution flaw in the safetydance library's set function (CWE-1321). The set function allows deep property assignment to objects via dot-notation paths without properly sanitizing input to prevent pollution of the Object prototype. An attacker can pass specially crafted property paths like "__proto__", "constructor", or "prototype" to inject properties into the Object prototype itself. This requires network access to an application using the vulnerable library and calling the set function with untrusted input. Successful exploitation allows arbitrary property injection affecting all objects in the application. The library has been archived and no patches are expected.
Affected products
- gramakri safetydance 0 through 1.1.1
Timeline
- 2020-10-02: disclosed
- 2022-02-10: advisory