Executive brief
jquery-plugin-query-object is a JavaScript library that parses URL query strings. A prototype pollution vulnerability allows attackers to inject properties into JavaScript's Object.prototype, potentially corrupting the behavior of any application using the library and enabling attacks like privilege escalation or remote code execution.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in jquery-plugin-query-object version 2.2.3 and all previous versions. The vulnerability is caused by improper handling of user-supplied input in URL query parsing, allowing an authenticated attacker to inject arbitrary properties into Object.prototype. The attack is network-accessible with low complexity and requires low privilege (authentication). An attacker can leverage this to modify the prototype chain, affecting all objects in the application and potentially leading to information disclosure, integrity compromise, or denial of service. No patch has been officially released as of the advisory publication date.
Affected products
- jquery-plugin-query-object jquery-query-object 0 through 2.2.3
Timeline
- 2021-04-23: disclosed
- 2022-05-24: advisory