Executive brief
Algolia's algoliasearch-helper is a JavaScript library that helps build search interfaces with Algolia search service. A vulnerability in how it processes search parameters can allow an attacker to pollute the application's object prototype, potentially affecting all JavaScript objects in the application. In the worst case, this could be exploited by an attacker to inject malicious code or alter application behavior, but only if the application allows users to define arbitrary search patterns.
Technical details
The vulnerability is a prototype pollution flaw in the SearchParameters._parseNumbers() function within src/SearchParameters/index.js. The vulnerable code uses a merge function without protection against prototype properties (CWE-1321, CWE-915), allowing an attacker to inject properties into the JavaScript Object prototype. The attack is network-based with no authentication or user interaction required, but is only exploitable when the application explicitly allows users to define arbitrary search patterns as input. An attacker who can control search pattern input can pollute the prototype chain, potentially achieving information disclosure, integrity violations, or denial of service. The vulnerability was patched in version 3.6.2 and fixed by filtering out invalid parameters during the merge operation.
Affected products
- Algolia algoliasearch-helper before 3.6.2
Timeline
- 2021-11-23: disclosed: Advisory published
- 2021-11-23: patched: Fix released in version 3.6.2