Executive brief
set-deep-prop is a utility library used to set values in deeply nested JavaScript objects. The library is vulnerable to prototype pollution, allowing attackers to inject malicious properties into the core JavaScript Object prototype. This can cause application crashes (denial of service), unexpected behavior, or in some cases remote code execution if the application evaluates object properties dynamically.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in set-deep-prop's core functionality. The library fails to sanitize user-controlled paths when setting nested properties, allowing an attacker to use special property names like "__proto__" to pollute Object.prototype. The vulnerability is reachable through the main API with no authentication required. An attacker can inject arbitrary properties into the prototype chain, affecting all JavaScript objects in the application. This can lead to denial of service (by breaking object methods), property injection (bypassing authorization checks), or remote code execution (if properties are evaluated). There is no patched version available; the project appears unmaintained.
Affected products
- set-deep-prop set-deep-prop all versions up to and including 1.0.0
Timeline
- 2021-03-08: disclosed
- 2022-07-26: advisory
- 2021-04-14: other: CVE-2021-23373 published