Executive brief
jszip is a popular JavaScript library for creating and manipulating ZIP files. The library was vulnerable to prototype pollution attacks, where specially crafted ZIP files with filenames matching JavaScript object prototype properties (like __proto__ or toString) could corrupt the internal object structure used by the library. While this vulnerability primarily impacts availability and code execution in certain contexts, exploitation typically requires crafted input and limited practical impact in most use cases.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in jszip versions before 3.7.0 (and all versions prior to 2.7.0). The root cause is improper handling of filenames when processing ZIP file entries; an attacker can craft a ZIP archive with filenames set to dangerous prototype property names (e.g., __proto__, toString, constructor) which are then used as keys in an object without proper sanitization. When these files are processed, the object prototype is modified, potentially leading to denial of service or property injection attacks. The vulnerability requires network access and involves processing an untrusted ZIP file, but requires no authentication or user interaction beyond opening the file. The fix, merged in June 2021, uses null prototype objects (Object.create(null)) to prevent prototype pollution.
Affected products
- jszip jszip before 3.7.0
Timeline
- 2021-07-25: disclosed
- 2021-08-10: advisory
- 2021-06-29: patched: Fix merged in PR #766