Executive brief
bmoor is a JavaScript utility library used by developers to bootstrap and manage object definitions in Node.js applications. A vulnerability in its set function allows attackers to pollute the JavaScript prototype chain by setting properties like __proto__, which can propagate to all objects in an application. This can cause the application to malfunction or be manipulated to perform unintended actions, particularly affecting availability and application integrity.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in bmoor's set function that fails to properly sanitize user-controlled path parameters. An attacker can exploit this via the set function call with specially crafted input like bmoor.set({}, [["__proto__"], "polluted"], "polluted") to inject properties into Object.prototype. The vulnerable component is the property-definition-by-path mechanism, which does not filter dangerous keys such as __proto__, constructor, or prototype. The attack requires no authentication or user interaction and is remotely exploitable; an attacker controlling input to the set function can pollute the prototype chain, affecting all objects created thereafter. Impact ranges from denial of service (by breaking inherited methods like toString() or valueOf()) to property injection attacks. This vulnerability was introduced as an incomplete fix for CVE-2020-7736. A patch is available in version 0.10.1.
Affected products
- bmoor bmoor <0.10.1
Timeline
- 2022-01-18: disclosed
- 2022-01-31: patched: Fixed in version 0.10.1
- 2022-02-01: advisory