Executive brief
rangy is a widely-used JavaScript library for working with text selections and ranges in web applications. A prototype pollution vulnerability in its extend() function allows an attacker to modify core JavaScript object properties, potentially affecting all objects created in the application. This could lead to unexpected behavior, logic bypass, or data corruption depending on what properties are polluted.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the extend() function in rangy-core.js. The function performs a recursive merge of objects without properly sanitizing property names, allowing an attacker to inject properties into Object.prototype by passing a crafted object with a "__proto__" or "constructor.prototype" key. No authentication or user interaction is required; an attacker can directly call rangy.util.extend() with a malicious JSON payload to pollute the prototype. Successful exploitation allows modification of Object.prototype properties, causing denial of service or unexpected behavior in downstream application logic. A patch is available, and users should upgrade to a version released after 1.3.1.
Affected products
- Tim Down rangy through 1.3.1
Timeline
- 2022-12-19: disclosed: Reported in GitHub issue #478
- 2023-02-24: advisory: GHSA-65rp-mhqf-8gj3 published on GitHub Advisory Database