Executive brief
JointJS is a JavaScript diagramming library used to create interactive flowcharts, organizational charts, and network diagrams. A prototype pollution vulnerability in the setByPath utility function allows an attacker to modify the JavaScript object prototype, potentially leading to unexpected application behavior, data manipulation, or authentication bypass in applications that use this library.
Technical details
A prototype pollution vulnerability exists in the setByPath function of JointJS versions before 3.4.2, caused by improper type handling when processing user-supplied keys as arrays in the path parameter. This issue is a type confusion bypass of a prior fix for CVE-2020-28480. An attacker can inject keys like "__proto__" or "constructor.prototype" through array parameters to pollute the Object prototype. No authentication or special privileges are required; exploitation requires network access and can be triggered if the application passes untrusted input to setByPath. Successful exploitation allows an attacker to inject or modify properties on the global Object prototype, affecting all JavaScript objects in the application context. The vulnerability was patched in version 3.4.2.
Affected products
- JointJS jointjs before 3.4.2
Timeline
- 2021-09-22: disclosed
- 2021-09-21: patched: Version 3.4.2 released