Executive brief
mockery is a JavaScript library used to mock and stub dependencies in application testing. A prototype pollution vulnerability in its enable() function allows attackers to modify JavaScript object prototypes, potentially compromising the integrity of applications that use this library during testing or runtime. An exploit could lead to unauthorized code execution or data manipulation within affected applications.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the enable() function of mockery.js, specifically via improper handling of the key variable. Prototype pollution occurs when user-controlled or untrusted input is merged into JavaScript object prototypes without proper validation, allowing an attacker to inject or override properties on Object.prototype. The vulnerable code is reachable through mockery's public API without authentication. An attacker can exploit this to pollute the prototype chain, affecting all objects in an application and potentially leading to arbitrary behavior changes or code execution. All versions up to and including 2.1.0 are affected, and the repository has been archived without a patch being released.
Affected products
- mfncooper mockery up to 2.1.0
Timeline
- 2022-10-12: disclosed: Advisory published
- 2024-04-30: other: Repository archived by owner without patch