Executive brief
Aurelia-path is a utility library used by the Aurelia web framework to handle website addresses and navigation. A security flaw allows attackers to inject malicious data into the application's core logic by sending specially crafted web links. This could allow an attacker to manipulate how the application behaves or potentially gain unauthorized access to data.
Technical details
A prototype pollution vulnerability exists in the `parseQueryString` function of the `aurelia-path` package. The root cause is improper validation of query string keys, allowing an attacker to use the `__proto__` property to modify the base `Object.prototype`. This is most commonly exploitable in applications using `aurelia-router`, where an attacker can provide a malicious URL containing a crafted query string. Successful exploitation can lead to property injection across the application, potentially resulting in remote code execution or bypass of security logic depending on the application's implementation. The issue is fixed in version 1.1.7.
Affected products
- Aurelia aurelia-path < 1.1.7
Timeline
- 2021-05-14: disclosed: Issue reported on GitHub
- 2021-09-26: patched: Version 1.1.7 released
- 2021-09-27: advisory: GitHub and NVD advisories published
References
- https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
- https://github.com/aurelia/path/issues/44
- https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1
- https://github.com/aurelia/path
- https://github.com/aurelia/path/releases/tag/1.1.7
- https://www.npmjs.com/package/aurelia-path