Executive brief
lutils is a collection of utility functions for JavaScript applications. A security flaw in its data merging function allows an attacker to inject malicious properties into the application's base objects. This can lead to application crashes, unauthorized changes to application logic, or potentially the execution of unauthorized commands, depending on how the application uses the library.
Technical details
The lutils library is vulnerable to prototype pollution through its main 'merge' function. The root cause is an unsafe recursive merge operation that fails to sanitize special JavaScript properties such as '__proto__'. By providing a specially crafted JSON object to the merge function, a remote attacker can inject or overwrite properties on the global Object.prototype. This can result in a Denial of Service (DoS) by breaking built-in methods, property injection to bypass security checks, or in specific circumstances, Remote Code Execution (RCE) if the polluted properties are later evaluated by the application. As of the advisory date, there is no fixed version available.
Affected products
- lutils_project lutils All versions up to 2.4.0
Timeline
- 2021-06-17: disclosed: Vulnerability disclosed by Snyk and NVD
- 2021-06-21: advisory: GitHub Advisory published