Executive brief
The keyget npm package is a utility for modifying nested JavaScript objects. A prototype pollution vulnerability in its set, push, and at methods allows attackers to inject malicious properties into the JavaScript object prototype, potentially causing application crashes or enabling remote code execution through corrupted object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the keyget npm package affecting versions up to 2.4.0. The set, push, and at methods fail to properly sanitize user-supplied keys, allowing attackers to pollute the Object prototype through specially crafted input. The attack is network-reachable and requires no authentication or user interaction if the application processes untrusted keys. Successful exploitation can cause denial of service via application crashes or potentially lead to remote code execution if the polluted properties are leveraged by the application logic. This vulnerability is an incomplete fix to an earlier prototype pollution issue (CVE-2020-28272).
Affected products
- keyget keyget 0.0.0 through 2.4.0
Timeline
- 2022-01-28: disclosed: CVE-2021-23760 published on NVD
- 2022-02-01: advisory: GHSA-9fp7-4fjm-q3mf published