Executive brief
The 'changeset' library, a tool used to synchronize and update JavaScript data objects, contains a security flaw that allows attackers to manipulate the fundamental structure of objects in memory. By sending specially crafted data, an attacker could crash the application or potentially execute unauthorized commands on the server. This could lead to a total service outage or a full system compromise.
Technical details
A prototype pollution vulnerability exists in the 'changeset' npm module versions 0.0.1 through 0.2.5. The root cause is located in the 'apply()' function, which fails to validate object properties before assignment. Specifically, the function does not check if the 'changes' argument contains sensitive keys like '__proto__'. An attacker can exploit this by supplying a malicious payload that injects properties into the global Object prototype. This can result in a Denial of Service (DoS) or potentially Remote Code Execution (RCE) depending on how the polluted properties are used elsewhere in the application. The issue was addressed in version 0.2.6 by adding checks for 'hasOwnProperty' and explicitly blocking the '__proto__' key.
Affected products
- eugeneware changeset 0.0.1 - 0.2.5
Timeline
- 2021-01-23: other: Vulnerability identified by WhiteSource (Mend)
- 2021-03-09: disclosed: NVD publication date
- 2021-03-09: patched: Fix committed to GitHub repository
- 2022-05-24: advisory: GitHub Advisory published