Executive brief
async is a widely used JavaScript utility library that provides asynchronous control flow functions. A prototype pollution vulnerability in the mapValues() method allows an attacker with control over input data to modify JavaScript object prototypes, potentially gaining unauthorized access or executing arbitrary code in applications using this library.
Technical details
A prototype pollution vulnerability exists in the async library's mapValues() method (CWE-1321), affecting versions 2.x through 2.6.3 and 3.x through 3.2.1. The vulnerability arises from insufficient validation of object keys in the mapValues() function, allowing malicious input to pollute the JavaScript Object prototype chain. An attacker must provide crafted input data to the vulnerable function; no network access or authentication is required if the application uses async with untrusted input. Successful exploitation can lead to privilege escalation and unauthorized code execution. Patches are available in versions 2.6.4 and 3.2.2.
Affected products
- Caolan async 2.0.0 through 2.6.3, 3.0.0 through 3.2.1
Timeline
- 2022-04-06: disclosed: CVE-2021-43138 published
- 2022-04: patched: Fixes released in async 2.6.4 and 3.2.2