Executive brief
dot-prop is a popular Node.js utility library for reading and writing object properties. A prototype pollution vulnerability allows an attacker to inject arbitrary properties into JavaScript objects, potentially leading to unexpected application behavior, data manipulation, or authentication bypass depending on how the affected application uses the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-425, CWE-471) in the dot-prop npm package that allows unauthenticated attackers to add arbitrary properties to JavaScript language constructs through specially crafted input. The vulnerable versions are all releases before 4.2.1 and versions in the 5.x series before 5.1.1. The attack requires no authentication or user interaction and is network-reachable if the affected library processes untrusted input. An attacker can pollute the prototype chain to modify object behavior across an entire application. Patches are available in version 4.2.1 and 5.1.1.
Affected products
- Sindre Sorhus dot-prop before 4.2.1, 5.0.0 to before 5.1.1
Timeline
- 2020-02-04: disclosed: NVD publication date
- 2020-07-29: advisory: GitHub Security Advisory published
- 2020-07-29: patched: Fix released in versions 4.2.1 and 5.1.1