Executive brief
set-or-get is a lightweight JavaScript utility library used to read and modify object properties. A prototype pollution vulnerability in versions 1.0.0 through 1.2.10 allows attackers to manipulate the base object prototype through specially crafted input, potentially enabling denial of service or remote code execution by modifying fundamental JavaScript object behavior.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the set-or-get library that affects versions 1.0.0 through 1.2.10. The vulnerable code fails to validate or restrict access to special JavaScript properties like __proto__, constructor, and prototype when setting object fields. An attacker with network access can send crafted input to an application using this library to pollute the Object prototype, causing denial of service or potentially achieving remote code execution by injecting malicious properties into the base object. The fix (version 1.2.11 and later) adds explicit checks to reject attempts to modify these magical attributes.
Affected products
- Ionică Bizău set-or-get 1.0.0 through 1.2.10
Timeline
- 2021-02-08: disclosed: NVD published date
- 2021-04-12: advisory: GHSA published
- 2021-04-12: patched: Fix released in version 1.2.11