Executive brief
dustjs-linkedin is a JavaScript template engine library used to render dynamic web content. A prototype pollution vulnerability allows attackers to modify object properties globally, enabling remote code execution through template compilation and evaluation. This could compromise any application using dustjs-linkedin to process untrusted template input.
Technical details
The vulnerability is a prototype pollution flaw in the compileBlocks function (lib/compiler.js) where a for-in loop iterates over context.blocks without proper ownership checking, allowing attackers to inject arbitrary properties into the prototype chain. When a malicious property is added to Object.prototype before template compilation, it gets incorporated into the compiled template code. The generated code is then evaluated in a VM context (vm.runInContext) where attackers can bypass the sandbox using this.constructor.constructor to achieve arbitrary code execution. The attack requires the ability to influence the template input or object prototype before compilation. A fix is available in version 3.0.0 and later.
Affected products
- LinkedIn dustjs-linkedin before 3.0.0
Timeline
- 2021-03-24: disclosed: Security vulnerability reported on GitHub issue #804
- 2022-12-21: patched: Version 3.0.0 released with fix (commit ddb6523832465d38c9d80189e9de60519ac307c3)
- 2022-12-21: advisory: GHSA-c6rp-wrp9-qr4q published