Executive brief
Firebase's utility library contains a vulnerability in its deepExtend function that allows attackers to pollute the object prototype of applications using the library. This can lead to unauthorized modification of application behavior and data integrity issues, potentially affecting any JavaScript application that depends on this library and processes untrusted input.
Technical details
This is a prototype pollution vulnerability (CWE-400: Uncontrolled Resource Consumption) in the @firebase/util library's deepExtend function in DeepCopy.ts. When processing user-supplied input through the deepExtend function, an attacker can inject properties into the __proto__ object, polluting the prototype chain and overwriting properties on all objects in the application. The vulnerability is network-reachable if the application accepts untrusted input and passes it to deepExtend. The attack requires no authentication or user interaction. Patch version 0.3.4 and later fix this by preventing __proto__ pollution in the deepExtend function.
Affected products
- Firebase @firebase/util before 0.3.4
Timeline
- 2021-05-18: disclosed: Public disclosure via GHSA
- 2020-10-27: patched: Fix merged in PR #4001