Executive brief
js-data is a popular JavaScript library for data management and object manipulation used in many web applications. The library is vulnerable to prototype pollution attacks through its deepFillIn and set functions, which allow an attacker to inject malicious properties into core JavaScript objects. This can lead to application crashes, data manipulation across the entire application, or remote code execution depending on how the affected application uses the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deepFillIn and set functions of js-data across all versions. An attacker can craft malicious input that modifies the Object prototype, affecting all objects in the JavaScript runtime. This is a known-incomplete fix for CVE-2020-28442, indicating the original patch did not fully address the root cause. The vulnerability requires no authentication and can be triggered remotely through application input that reaches the affected functions. An attacker can achieve arbitrary property injection into the prototype chain, potentially leading to privilege escalation, data exfiltration, or code execution. Patches are available in versions after 3.0.10.
Affected products
- js-data js-data all versions up to and including 3.0.10
Timeline
- 2021-05-08: disclosed
- 2022-01-06: advisory
- other: NVD published 2021-12-24