Executive brief
jquery-bbq is a popular JavaScript library used to parse and manage URL query string parameters in web applications. A prototype pollution vulnerability in this library allows an attacker with network access to inject malicious properties into the core JavaScript object prototype, potentially compromising the application's behavior, stealing data, or executing unintended code logic.
Technical details
jquery-bbq versions up to 1.2.1 contain an improperly controlled modification of object prototype attributes (CWE-1321). The vulnerability stems from insufficient input validation when parsing and processing URL query string parameters, allowing an attacker to inject properties into Object.prototype. The attack is network-reachable with no authentication required; an attacker can craft a malicious URL containing prototype pollution payloads that, when processed by a vulnerable application, pollutes the global object prototype. This can lead to arbitrary behavior changes in the application or data exposure, depending on how the application logic uses prototype-inherited properties. No patch has been released; applications should either upgrade to a patched version or remove use of this unmaintained library.
Affected products
- jquery-bbq jquery-bbq 1.2.1 and earlier
Timeline
- 2021-04-23: disclosed
- 2021-05-24: advisory