Executive brief
min-dash is a utility library used by web applications to manage data objects. A security flaw allows an attacker to inject malicious properties into the application's core data structures. This can lead to application crashes or unpredictable behavior, potentially disrupting services for users.
Technical details
A prototype pollution vulnerability exists in the 'set' method of the min-dash library due to improper validation of input keys. Specifically, the method failed to enforce strict key types and did not sufficiently block access to the '__proto__' and 'constructor' properties when processing nested object paths. An attacker can provide a specially crafted path (e.g., using nested arrays or specific property names) to overwrite properties on the base Object prototype. This can be exploited to cause a denial of service (DoS) or potentially achieve remote code execution depending on how the polluted properties are used by the application. The issue is fixed in version 3.8.1 by enforcing that keys must be strings or numbers and explicitly blocking sensitive property names.
Affected products
- bpmn-io min-dash < 3.8.1
- org.webjars.npm min-dash < 3.8.1
Timeline
- 2021-01-17: patched: Fix merged into master branch
- 2022-01-21: advisory: NVD published the CVE record
- 2022-02-01: disclosed: GitHub Advisory published
References
- https://github.com/bpmn-io/min-dash/security/advisories/GHSA-2m53-83f3-562j
- https://github.com/bpmn-io/min-dash/pull/21
- https://github.com/bpmn-io/min-dash/commit/2c6689e2aa29f4b66a4874a2f3003431e9db48d1
- https://github.com/bpmn-io/min-dash
- https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127