Executive brief
nested-object-assign is a popular JavaScript library used by developers to merge or assign nested objects. The library contains a prototype pollution vulnerability that allows attackers to inject malicious properties into the JavaScript Object prototype, potentially affecting all objects created by an application. This could enable attackers to bypass security controls, alter application behavior, or cause denial of service conditions.
Technical details
The vulnerability is a prototype pollution flaw in the default function of nested-object-assign before version 1.0.4. The library fails to restrict modifications to sensitive JavaScript prototype properties such as __proto__, constructor, and prototype during object assignment operations. An attacker can craft specially formatted input that, when processed by the library, injects properties into Object.prototype, which are then inherited by all objects in the application. The attack requires network access and the ability to pass untrusted data to the affected function, but requires no authentication or user interaction. The fix, implemented in version 1.0.4 and merged on January 28, 2021, prevents modification of object prototypes.
Affected products
- Geta nested-object-assign before 1.0.4
Timeline
- 2021-02-01: disclosed: GHSA advisory published
- 2021-01-28: patched: Security fix merged; version 1.0.4 released