Executive brief
hello.js is a widely-used JavaScript SDK for integrating social login and authentication. The library contains a prototype pollution vulnerability that allows remote attackers to inject malicious properties into JavaScript object prototypes, potentially enabling cross-site scripting attacks and arbitrary code execution on websites using the library.
Technical details
The vulnerability exists in the hello.utils.extend function, which recursively merges objects without properly validating property names. When processing URL parameters (hash fragments), the function fails to filter reserved properties like "__proto__", allowing attackers to pollute the Object prototype. An attacker can craft a malicious URL containing a hash parameter like "#state={...,__proto__:{callback:alert}}" to inject code into the prototype chain. This is a network-based attack requiring no authentication or user interaction beyond visiting a link. Exploitation can lead to arbitrary JavaScript execution and XSS. The vulnerability was patched in version 1.18.8.
Affected products
- MrSwitch hello.js prior to 1.18.8
Timeline
- 2021-01-28: disclosed: Issue #634 opened on GitHub
- 2021: patched: Fixed in version 1.18.8
- 2023-08-11: advisory: GHSA-g3vf-47fv-8f3c published