Executive brief
Proto is a JavaScript library for creating objects with template functionality. The library's merge function is vulnerable to prototype pollution, which allows an attacker to inject malicious properties into JavaScript object prototypes. This can lead to denial of service, property injection attacks that bypass security checks, or in some cases remote code execution depending on how the application uses the affected objects.
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in the Proto library's merge function. The unsafe recursive merge implementation fails to properly sanitize the __proto__ property, allowing attackers to inject arbitrary properties into Object.prototype. An attacker can craft a malicious JSON payload with __proto__ as a key and pass it to the merge function to pollute the prototype chain. The vulnerability requires the attacker to control data passed to the merge function, typically through application input parsing. Successful exploitation can cause denial of service by corrupting inherited object properties, bypass security checks by injecting isAdmin or similar properties, or enable remote code execution if the application evaluates polluted properties. No patched version is currently available for Proto.
Affected products
- Proto all versions up to and including 1.1.4
Timeline
- 2021-07-08: disclosed
- 2021-09-02: advisory