Executive brief
The sds JavaScript library contains a prototype pollution vulnerability in its object property setter function, allowing an attacker to inject or modify properties on the Object.prototype. This can lead to unexpected behavior in applications using the library, potentially enabling attackers to modify shared properties affecting all object instances and compromise application logic or data integrity.
Technical details
The vulnerability is a prototype pollution flaw in the set function (js/set.js) within the sds npm package versions 0.0.0 through 4.4.0. The library fails to properly validate user-supplied property names, allowing an attacker to inject properties into Object.prototype through specially crafted input. This is a re-occurrence from an incomplete fix to CVE-2020-7618. The attack requires no authentication and is network-reachable if the application processes untrusted input through the vulnerable set function. Successful exploitation allows modification of prototype properties affecting all objects in the application runtime.
Affected products
- sds sds 0.0.0 through 4.4.0
Timeline
- 2022-05-14: disclosed
- 2022-05-13: advisory: NVD published