Executive brief
safe-obj is a Node.js library used to safely access and manipulate object properties. A prototype pollution vulnerability allows attackers to modify the JavaScript prototype chain, which can cause the application to crash (denial of service) or potentially execute arbitrary code on the server running the vulnerable library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in safe-obj versions 1.0.0 through 1.0.2. The library fails to properly sanitize user-supplied object property paths before assigning values, allowing an attacker to inject properties into Object.prototype or other built-in prototypes via specially crafted input. This is a network-exploitable vulnerability with no authentication required. Exploitation can lead to denial of service or remote code execution depending on how the affected application uses the polluted prototype properties. Versions beyond 1.0.2 should be used to mitigate this issue.
Affected products
- safe-obj 1.0.0 through 1.0.2
Timeline
- 2021-04-26: disclosed
- 2021-06-21: advisory