Executive brief
Litespeed.js is a JavaScript library used for URL query string parsing. A prototype pollution flaw allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to application behavior manipulation, denial of service, or code execution depending on how the application uses the parsed data.
Technical details
A prototype pollution vulnerability exists in the getJsonFromUrl function of litespeed.js due to improper sanitization of keys extracted from query strings. An attacker can craft a malicious URL with special key names (e.g., "__proto__" or "constructor") to pollute the JavaScript object prototype. This is a network-reachable attack requiring no authentication or user interaction. Depending on the consuming application's logic, successful exploitation can lead to denial of service, information disclosure, or remote code execution. The vulnerability was patched in litespeed.js version 0.3.12 and in Appwrite versions 0.11.1 and 0.12.2.
Affected products
- litespeed-js litespeed.js before 0.3.12
- Appwrite server-ce 0.12.0 through 0.12.1 and 0.1.13 through 0.11.0
Timeline
- 2022-02-17: disclosed
- 2022-02-11: patched: litespeed.js 0.3.12 released; Appwrite 0.12.2 and 0.11.1 released