Junglewise Threat Intelligence

CVE-2022-21189: Dexie prototype pollution in setByKeyPath

CVE-2022-21189 · Severity: low · CVSS 3.1 · Published 2022-05-03

Executive brief

Dexie is a popular library used by web applications to manage data stored within the browser's database (IndexedDB). A security flaw in how it handles data updates allows an attacker to inject malicious properties into the application's core JavaScript objects. This could lead to unauthorized data modification, application crashes, or potentially full control over the user's session within the affected web application.

Technical details

A prototype pollution vulnerability exists in Dexie's 'Dexie.setByKeyPath(obj, keyPath, value)' utility function. The function fails to sanitize or block sensitive keys such as '__proto__' and 'constructor', allowing an attacker to traverse and modify the global 'Object.prototype'. This can be triggered when the library processes untrusted user input, such as during a 'Collection.modify()' operation. Successful exploitation can lead to denial of service, property injection, or remote code execution depending on the application's environment. The issue is fixed in versions 3.2.2 and 4.0.0-alpha.3.

Affected products

  • dexie dexie < 3.2.2, >= 4.0.0-alpha.1 < 4.0.0-alpha.3

Timeline

  • 2022-04-11: disclosed: Vulnerability disclosed by Snyk Security Team
  • 2022-05-01: advisory: NVD published CVE-2022-21189
  • 2022-05-03: advisory: GitHub Advisory published GHSA-3xgx-r9j4-qw9w

References