Executive brief
steal is a JavaScript module loader used in web applications to dynamically load and manage dependencies. A prototype pollution vulnerability allows an attacker to inject arbitrary properties into JavaScript objects, potentially leading to unauthorized access to sensitive data, modification of application behavior, or execution of malicious code within the application context.
Technical details
A prototype pollution vulnerability exists in steal version 2.3.0 and earlier, specifically in the optionName variable processing within main.js. The vulnerability arises from insufficient sanitization of object property assignments, allowing an attacker to inject properties into the Object prototype chain. An attacker with network access can craft malicious input to exploit this vulnerability without requiring authentication or user interaction. Successful exploitation can result in confidentiality, integrity, and availability impacts depending on how the polluted properties are used by the application. Affected versions are all releases up to and including 2.3.0.
Affected products
- steal steal up to and including 2.3.0
Timeline
- 2022-09-16: disclosed
- 2022-09-14: other: vulnerability reported