Executive brief
steal is a module loader and builder for JavaScript applications. A prototype pollution vulnerability in its babel.js component allows an attacker to inject and manipulate object prototypes through the alias variable, potentially enabling unauthorized modification of application behavior, data corruption, or code execution on affected systems.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in stealjs steal version 2.3.0 and earlier, specifically in the babel.js extension's handling of the alias variable. The vulnerability exists in babel.js at lines 4216 and 4569, where unsanitized user input is used to set object properties without proper validation. An attacker with network access can exploit this via the babel configuration to pollute Object.prototype by injecting malicious alias entries, affecting all objects created after the attack. This is a network-reachable vulnerability requiring no authentication or user interaction, allowing arbitrary property injection that can lead to application compromise or denial of service.
Affected products
- stealjs steal 0 through 2.3.0
Timeline
- 2022-09-21: disclosed
- 2022-09-20: advisory: NVD published advisory