Executive brief
Dynamoose is a popular Node.js library that provides an abstraction layer for Amazon DynamoDB database operations. A prototype pollution vulnerability in an internal utility method allows unauthenticated attackers to inject malicious properties into JavaScript objects, potentially compromising application logic and enabling privilege escalation or data manipulation across affected systems.
Technical details
A prototype pollution vulnerability exists in the lib/utils/object/set.ts utility method in Dynamoose versions 2.0.0 through 2.6.0. The vulnerable method is used throughout the codebase for object operations and does not properly sanitize user-supplied input before setting object properties, allowing attackers to inject properties into the Object prototype. This vulnerability is reachable via network-accessible Dynamoose APIs without authentication. An attacker can manipulate the object prototype to alter application behavior, bypass security checks, or escalate privileges depending on how the application uses Dynamoose. The vulnerability is fixed in version 2.7.0; no workarounds are available other than upgrading.
Affected products
- Dynamoose Dynamoose 2.0.0-2.6.0
Timeline
- 2021-02-08: disclosed
- 2021-02-08: patched: v2.7.0 released with patch