Executive brief
A vulnerability was found in utils.js, a JavaScript utility library used for common programming tasks. An attacker could exploit this flaw to modify the behavior of the application or gain unauthorized access to data. This could lead to a complete takeover of the affected application or cause it to crash, impacting business operations and data integrity.
Technical details
The utils.js library is vulnerable to Prototype Pollution via the ObjectUtil component. The root cause is an improperly controlled modification of object prototype attributes when processing keys such as '__proto__'. An attacker can exploit this by providing specially crafted input that reaches the vulnerable object manipulation functions, allowing them to inject properties into the global Object prototype. This can lead to remote code execution, denial of service, or bypass of security checks. The issue is fixed in version 0.17.2 by explicitly checking for and blocking the '__proto__' key during object traversal.
Affected products
- fabiocaccamo utils.js < 0.17.2
Timeline
- 2021-12-08: disclosed
- 2021-12-09: patched: Fixed in version 0.17.2
- 2021-12-10: advisory