Executive brief
object-collider is a JavaScript library used for merging and manipulating objects. A prototype pollution vulnerability in versions 1.0.0 through 1.0.3 allows attackers to inject malicious properties into object prototypes, potentially causing denial of service or remote code execution through specially crafted inputs.
Technical details
A prototype pollution vulnerability exists in object-collider due to improper handling of the __proto__ property during object merging operations. The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Attackers can exploit this by supplying malicious input containing __proto__ keys to pollute the prototype chain, affecting all objects in the application. This can lead to denial of service or remote code execution depending on how the polluted properties are used. The vulnerability has been patched in version 1.0.4.
Affected products
- FireBlinkLTD object-collider 1.0.0 through 1.0.3
Timeline
- 2021-03-01: disclosed
- 2021-03-19: advisory
- 2021-03-16: patched: Fix committed to address __proto__ property handling