Executive brief
ts-nodash is a TypeScript library for object manipulation. The library contains a prototype pollution vulnerability in its Merge() function that allows an attacker to modify the base JavaScript object prototype by injecting malicious properties. This can enable remote code execution, privilege escalation, or denial of service depending on how the application uses object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the recursive object merge logic. The Merge() function failed to validate or sanitize object keys, allowing an attacker to pass specially crafted JSON with __proto__, constructor, or prototype properties that would pollute the base Object prototype. When a malicious object is merged with a benign one, these special keys are processed as regular properties, leading to prototype chain contamination. An attacker can exploit this via network by crafting JSON input (no authentication required), potentially achieving remote code execution if the application evaluates polluted properties, privilege escalation by polluting security checks, or denial of service by corrupting critical object methods. The fix in version 1.2.7 added an isPrototypePolluted() check to skip dangerous keys during the merge operation.
Affected products
- BadOPCode ts-nodash before 1.2.7
Timeline
- 2021-06-17: disclosed: Vulnerability disclosed to Snyk
- 2021-07-02: advisory: NVD published CVE-2021-23403
- 2021-07-06: patched: Fix merged in commit b9cc2b3; version 1.2.7 released