Executive brief
objection.js is a popular object-relational mapping (ORM) library for JavaScript used to manage database queries and interactions. A prototype pollution vulnerability allows an attacker to modify core JavaScript object properties, which could lead to unexpected application behavior, privilege escalation, or complete compromise of the application depending on how the modified properties are used.
Technical details
objection.js prior to version 2.2.16 is vulnerable to prototype pollution (CWE-1321, CWE-915) due to improperly controlled modification of object prototype attributes when path components are not strings. An unauthenticated attacker can exploit this via a network vector with no special privileges or user interaction required to achieve confidentiality, integrity, and availability impact. The vulnerability was patched in version 2.2.16, with fixes applied in commits 46b842a and b41aab8 that add proper type checking for path components in the objectUtils.js utility module.
Affected products
- Vincit objection prior to 2.2.16
Timeline
- 2021-09-07: disclosed
- 2021-09-07: patched: Fixed in version 2.2.16