Executive brief
MooTools is a JavaScript library used for object-oriented web development and common utility functions. A prototype pollution vulnerability in the Object.merge() method allows attackers to inject arbitrary properties into JavaScript objects through untrusted input, potentially modifying application behavior or exposing sensitive data.
Technical details
The vulnerability is a prototype pollution flaw in the mootools library affecting all versions up to 1.5.2. The root cause is improper validation of untrusted input passed to the Object.merge() function, which fails to sanitize keys like "__proto__", "constructor", or "prototype". An attacker can craft malicious objects that, when merged, pollute the Object prototype and affect all objects in the application. The attack requires user interaction (UI:R) but no authentication or special privileges. Exploitation allows modification of object properties across the application, leading to logic bypass or information disclosure.
Affected products
- MooTools mootools all versions up to 1.5.2
Timeline
- 2021-08-24: disclosed: Initial disclosure on NVD
- 2021-09-02: advisory: GitHub advisory GHSA-x6hx-7gh3-3q98 published