Executive brief
browserify-shim is a Node.js build tool that enables the use of browser-oriented libraries in CommonJS environments. A prototype pollution vulnerability in the resolveShims function allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to arbitrary code execution, data manipulation, or denial of service in applications using affected versions.
Technical details
A prototype pollution vulnerability exists in the resolveShims function within resolve-shims.js (versions ≤ 3.8.15), triggered via the k variable. The vulnerability allows an attacker to pollute the JavaScript Object prototype by crafting malicious input that assigns properties to the prototype chain. No authentication or user interaction is required; the vulnerability is triggered during the build/shim resolution process. Successful exploitation enables arbitrary property injection into all JavaScript objects, leading to code execution, function override, or application logic bypass. The vulnerability was patched in version 3.8.16 via commit 97855e622b6dcd117c77e6583701962ff45e7338.
Affected products
- thlorenz browserify-shim 0 through 3.8.15
Timeline
- 2022-10-12: disclosed: Vulnerability advisory published
- 2022-10-11: patched: Fixed in version 3.8.16