Executive brief
backbone-query-parameters is a JavaScript library that parses URL query parameters for use with the Backbone.js framework. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript's Object.prototype, potentially affecting all objects in an application and enabling unauthorized data modification or code execution.
Technical details
The vulnerability is a Prototype Pollution (CWE-1321) flaw in the _setParamValue function of backbone-query-parameters version 0.4.0 and earlier. The function inadequately sanitizes query parameter names, allowing attackers to inject properties via special keys like "__proto__" or "constructor.prototype" when parsing URL query strings. An authenticated or network-accessible attacker can craft malicious URLs containing prototype pollution payloads in query parameters. Exploitation allows modification of the Object.prototype chain, potentially leading to property injection, denial of service, or JavaScript code execution depending on the application context. No patch information is readily available in the advisory; affected applications should consider alternative libraries or implement strict input validation.
Affected products
- jsDelivr backbone-query-parameters 0.4.0 and earlier
Timeline
- 2021-04-23: disclosed: CVE-2021-20085 published on NVD
- 2021-05-06: advisory: GHSA-8qpm-5c82-rf96 published