Executive brief
think-helper is a utility library used by ThinkJS applications to provide helper functions. A prototype pollution vulnerability allows an attacker to modify the behavior of the application by injecting malicious properties into object prototypes, potentially leading to arbitrary code execution or application malfunction depending on how the library is used downstream.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in think-helper where the library fails to properly validate and sanitize input when initializing or updating object properties. An attacker can craft input that modifies the Object prototype itself, affecting all objects in the application. The vulnerability is network-accessible and requires no authentication or user interaction. The attack can result in integrity compromise (application behavior modification). The vulnerability is fixed in version 1.1.3 and later; all prior versions are affected.
Affected products
- thinkjs think-helper < 1.1.3
Timeline
- 2021-06-30: disclosed: Advisory published
- 2021-07-01: patched: Fixed in version 1.1.3