Executive brief
dotty is a JavaScript utility library for working with nested object properties. A type confusion vulnerability allows attackers to bypass prototype pollution protections by using arrays in object path parameters, potentially leading to unauthorized modification of object properties and application behavior.
Technical details
This is a type confusion vulnerability (CWE-843) in dotty's path parameter handling that enables prototype pollution attacks. The vulnerability exists because the library does not properly validate input when user-provided keys are arrays, allowing an attacker to bypass the protections implemented in a previous patch for CVE-2021-25912. An attacker can supply specially crafted array-based path parameters to modify object prototypes, affecting all objects created or used by the application. The vulnerability was fixed in version 0.1.2 via commit 88f6186.
Affected products
- dotty dotty before 0.1.2
Timeline
- 2021-11-08: disclosed
- 2021-11-08: patched: Version 0.1.2 released with fix