Executive brief
klona is a popular JavaScript library used to deep clone objects in web applications. A flaw in input validation allows attackers to inject malicious data that can corrupt the application's object prototypes, potentially leading to remote code execution or complete service disruption without requiring authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw (CWE-20: Improper Input Validation) in klona versions 1.1.0 and earlier. The library fails to properly sanitize the "__proto__" property during deep cloning operations, allowing an attacker to pollute the Object prototype chain. An attacker can craft a malicious object that, when cloned by klona, modifies shared prototype properties affecting all objects in the application. The attack is remotely exploitable via network over a vulnerable code path with no authentication or special preconditions required. This can result in remote code execution or denial of service depending on how the application uses the polluted prototype. The fix was released in version 1.1.1, which adds an explicit guard against "__proto__" manipulation.
Affected products
- klona klona <= 1.1.0
Timeline
- 2021-04-13: disclosed
- 2021-04-13: patched: Fix released in version 1.1.1
- 2020-02-04: other: NVD published date