Executive brief
superjson is a serialization library used by Blitz.js and other applications to safely deserialize complex JavaScript objects from JSON. A critical flaw in how it handles user-controlled deserialization paths allows attackers to modify core JavaScript object prototypes without authentication, leading to complete server compromise. Any web application exposing at least one endpoint that deserializes superjson data can be exploited to execute arbitrary code and steal or manipulate all data on the server.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) combined with code injection (CWE-94) in superjson's deserialization logic. The library implements custom logic to handle circular references and complex data types via a "referentialEqualities" metadata field. This field specifies object path assignments to be applied during deserialization; because the destination paths are not validated, an attacker can use paths like "__proto__.x" to pollute Object.prototype. Once prototype properties are polluted, attackers can trigger gadget chains in Node.js or application dependencies to achieve remote code execution. The attack requires no authentication or user interaction—only network access to an endpoint processing superjson data. Patches were released in superjson 1.8.1 and Blitz.js 0.45.3.
Affected products
- superjson superjson < 1.8.1
- blitz-js blitz < 0.45.3
Timeline
- 2022-02-09: disclosed: Vulnerability published via GHSA-5888-ffcr-r425
- 2022-02-09: patched: superjson 1.8.1 and Blitz.js 0.45.3 released with patches