Executive brief
mootools-more is a widely-used JavaScript library that extends functionality for web applications. A prototype pollution vulnerability in the String.parseQueryString method allows attackers to inject arbitrary properties into the Object prototype, potentially affecting all objects created in the application and leading to data corruption, unauthorized access, or code execution.
Technical details
The vulnerability is an instance of prototype pollution (CWE-1321) in the parseQueryString function of mootools-more versions up to 1.6.0. The vulnerable code improperly handles user-controlled input when parsing query string parameters, allowing an attacker to inject properties into the Object.prototype by crafting malicious input (e.g., using __proto__ or constructor.prototype in query strings). The vulnerability requires network access and can be exploited from client-side JavaScript without authentication. Successful exploitation enables modification of object properties that affect application logic, potentially leading to privilege escalation, data integrity violations, or circumvention of security controls. A patch is available in the mootools-more repository.
Affected products
- mootools mootools-more through 1.6.0
Timeline
- 2021-04-23: disclosed: CVE published on NVD
- 2022-05-24: advisory: GHSA advisory published