Executive brief
putil-merge is a lightweight JavaScript library used to merge multiple objects together. A prototype pollution vulnerability in the merge() function allows an attacker to inject malicious properties into JavaScript object prototypes by supplying specially crafted input, potentially causing denial of service or enabling privilege escalation in applications that rely on object properties for access control.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the merge() function of putil-merge versions before 3.8.0. The function does not properly validate or sanitize object properties during recursive merge operations, allowing an attacker to inject a crafted object with a "constructor" property that pollutes the Object.prototype. An attacker can supply a JSON payload containing {"constructor": {"prototype": {"polluted": "yes"}}} which, when merged into an object with deep:true option, injects arbitrary properties into the base Object prototype inherited by all objects in the application. This attack requires network access if the library processes untrusted input (such as JSON from API requests), but no authentication. The impact includes denial of service through prototype property tampering or property injection attacks that could lead to privilege escalation if applications check prototype-inherited properties for authorization. The vulnerability was fixed in version 3.8.0.
Affected products
- panates putil-merge <3.8.0
Timeline
- 2022-02-02: disclosed
- 2022-02-05: advisory
- 2022-02-04: patched: Fix committed to repository