Executive brief
tough-cookie is a widely-used JavaScript library for parsing and managing HTTP cookies. A prototype pollution vulnerability allows attackers to poison the global Object prototype by crafting malicious cookies with `Domain=__proto__`, potentially affecting all JavaScript objects in an application and leading to unexpected behavior or security bypasses.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321) in the MemoryCookieStore of tough-cookie versions before 4.1.3. The root cause is improper object initialization: the code uses `this.idx = {}` as a plain object and stores cookies keyed by `cookie.domain` without sanitizing special properties like `__proto__`. When an attacker provides a cookie with `Domain=__proto__`, the assignment `this.idx[cookie.domain][cookie.path][cookie.key] = cookie` pollutes the Object prototype. This only occurs when CookieJar is instantiated with `rejectPublicSuffixes=false`. The attack requires no authentication or user interaction—an attacker simply needs to trigger cookie storage via the setCookie() method. Exploitation can corrupt the prototype chain, affecting all objects in the application. A patch was released in version 4.1.3; the fix likely uses `Object.create(null)` or a Map to avoid prototype pollution.
Affected products
- Salesforce tough-cookie before 4.1.3
Timeline
- 2023-06-02: disclosed
- 2023-07-01: advisory
- 2023-07-01: patched: version 4.1.3 released