Executive brief
object-path is a popular npm library for manipulating JavaScript object properties using path strings. A type confusion vulnerability allows attackers to bypass prototype pollution protections by using array-based path components instead of strings, potentially enabling modification of core JavaScript object properties and affecting any application using this library.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-843) affecting object-path versions before 0.11.6. The vulnerability is a type confusion bypass: the code checks if currentPath === '__proto__' using strict equality, but when path components are arrays rather than strings, the comparison fails (e.g., ['__proto__'] !== '__proto__'), allowing the bypass of CVE-2020-15256 protections. An attacker can craft a specially-formed path using array components to pollute the Object prototype and modify properties accessible to other parts of the application. The attack requires network access and knowledge of the application's path structure but no authentication. A patch is available in version 0.11.6 and later.
Affected products
- npm object-path before 0.11.6
Timeline
- 2021-08-27: disclosed
- 2021-09-01: published
- 2021-08-30: patched: fix commit available