Executive brief
x-assign is a JavaScript library that merges nested objects and concatenates arrays, commonly used in Node.js applications. The library fails to safely handle the __proto__ property, allowing an attacker to pollute the Object prototype and inject arbitrary properties into all JavaScript objects. This can lead to denial of service, property injection attacks affecting application logic (such as privilege escalation), or remote code execution if the application evaluates object properties as code.
Technical details
x-assign contains a prototype pollution vulnerability (CWE-1321, CWE-915) in its recursive object merge function. The vulnerability arises because the merge logic recursively processes source objects without sanitizing or blocking the __proto__ property, allowing an attacker to assign properties to Object.prototype. An attacker can supply a malicious JSON object with a __proto__ property containing arbitrary values. When x-assign merges this object with a legitimate target, the __proto__ property causes the merge to recurse on Object.prototype itself, polluting the global prototype. This affects all JavaScript objects in the application. The attack requires no authentication and is triggered through network-supplied data (such as JSON inputs). Impacts include denial of service (by corrupting critical Object methods), privilege escalation (by polluting security-related properties like isAdmin), or remote code execution (if the application evaluates object properties). No patched version of x-assign is available; the library remains affected in all released versions (0.1.4 and earlier).
Affected products
- x-assign developers x-assign 0.1.4 and all previous versions
Timeline
- 2021-10-18: disclosed
- 2021-10-21: advisory