Executive brief
pathval is a JavaScript utility library used in testing frameworks to access nested object properties. A prototype pollution vulnerability in versions prior to 1.1.1 allows an attacker with high privilege access to modify the behavior of all JavaScript objects by polluting the prototype chain, potentially enabling unauthorized code execution or data tampering across an application.
Technical details
pathval is vulnerable to prototype pollution (CWE-1321) in its path parsing logic, where it fails to properly sanitize sensitive property names like "constructor", "__proto__", and "prototype" when accessing nested object properties. An attacker with administrative or high-privilege access can craft malicious input that, when processed through the library's property access functions, pollutes the JavaScript Object prototype. This allows modification of properties on all objects in the application, potentially leading to privilege escalation, code execution, or integrity violations. The vulnerability was fixed in version 1.1.1 by adding explicit checks to reject these dangerous property names during path parsing.
Affected products
- chaijs pathval < 1.1.1
Timeline
- 2020-10-26: disclosed
- 2020-08-25: patched
- 2022-02-10: advisory