Executive brief
madlib-object-utils is a JavaScript utility library for object manipulation used in Node.js applications. A prototype pollution vulnerability in the setValue method allows an attacker to inject malicious properties into object prototypes, potentially corrupting application logic and enabling code execution or data manipulation across the application.
Technical details
The setValue method in madlib-object-utils versions before 0.1.8 is vulnerable to prototype pollution, allowing attackers to inject properties into Object.prototype through crafted input containing __proto__ or constructor.prototype keys. The vulnerability is reachable via network if the library processes untrusted user input (e.g., JSON payloads). No authentication or user interaction is required. Successful exploitation enables modification of object prototypes affecting all objects in the application, leading to logic bypass, authentication bypass, or code execution. The fix was applied in version 0.1.8 by adding prototype pollution checks to the setValue method.
Affected products
- Qwerios madlib-object-utils before 0.1.8
Timeline
- 2022-04-16: disclosed
- 2022-04-16: patched: version 0.1.8