Executive brief
dot-lens is a JavaScript library for fast property access and manipulation via dot-notation paths. A prototype pollution vulnerability in its set() function allows attackers to modify JavaScript object prototypes, potentially affecting the behavior of all objects in an application. This could lead to denial of service, authentication bypass, or other malicious behavior depending on how the application uses inherited object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the set() function within index.js of all versions of dot-lens up to 1.2.3. An attacker can supply a specially crafted path string (e.g., "__proto__" or "constructor.prototype") to the set() function to pollute the Object prototype chain. The attack requires no authentication and is network-reachable if the application accepts untrusted input and passes it to dot-lens. Successful exploitation allows modification of inherited object properties across the entire application, potentially enabling denial of service or logical attacks. No patch has been released as of the advisory publication date.
Affected products
- dot-lens all versions up to 1.2.3
Timeline
- 2023-03-06: disclosed: Advisory published
- 2023-03-07: other: GitHub reviewed