Executive brief
jquery-deparam is a JavaScript library for parsing URL query strings. A prototype pollution vulnerability allows an attacker to inject malicious properties into JavaScript object prototypes, which can lead to unexpected behavior, bypasses of security checks, or code execution in web applications that use this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in jquery-deparam that fails to properly validate or sanitize input when parsing URL query parameters. An authenticated attacker can craft malicious query strings containing specially crafted parameter names that pollute Object.prototype, injecting arbitrary properties that affect all JavaScript objects in the application runtime. This can lead to confidentiality, integrity, and availability impacts depending on how the polluted properties are used by the application. No patch information is available in the advisory.
Affected products
- jquery-deparam jquery-deparam 0.5.3 and earlier
Timeline
- 2021-04-23: disclosed
- 2021-05-24: advisory