Junglewise Threat Intelligence

CVE-2023-26113: collection.js prototype pollution in extend function

CVE-2023-26113 · Severity: low · CVSS 3.1 · Published 2023-03-18

Vendors: npm.

Executive brief

collection.js is a popular JavaScript library for working with collections of data. A prototype pollution vulnerability in its extend function allows attackers to inject properties into the core JavaScript Object prototype, which affects all objects in an application. This could cause application crashes (denial of service), enable privilege escalation by injecting false permissions, or in some cases allow remote code execution if the application evaluates untrusted object properties.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the extend function located in Collection.js/dist/node/iterators/extend.js. The function performs unsafe recursive object merging without filtering the special __proto__ property. When an attacker supplies a crafted JSON payload containing "__proto__" with nested properties, the merge operation pollutes the Object prototype with attacker-controlled values. The attack requires no authentication and is network-accessible if the application processes untrusted JSON through the extend function. Impact ranges from denial of service (by corrupting Object methods like toString) to property injection (bypassing isAdmin checks) and potentially remote code execution if object properties are evaluated as code. The fix, released in version 6.8.1, explicitly filters out the __proto__ key during merge operations.

Affected products

  • kobezzza collection.js before 6.8.1

Timeline

  • 2022-12-29: disclosed: Initial disclosure on GitHub issue #27
  • 2023-03-10: patched: Fixed in version 6.8.1
  • 2023-03-18: advisory: CVE-2023-26113 and GHSA-47pj-q2vm-46xc published

References