Junglewise Threat Intelligence

CVE-2023-26158: mockjs prototype pollution via Util.extend function

CVE-2023-26158 · Severity: low · CVSS 3.1 · Published 2023-12-08

Vendors: npm.

Executive brief

mockjs is a JavaScript library used to generate realistic test data and mock API responses during front-end development. A prototype pollution vulnerability in its core utility function allows attackers to modify or add properties to JavaScript's object prototype, which could interfere with application logic that relies on specific object attributes or break built-in functions.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the Util.extend function, which fails to validate object property names before assigning them. An attacker controlling input to Mock.Handler, Mock.Random, Mock.RE.Handler, or Mock.Util can exploit this by passing objects with "__proto__", "constructor", or "prototype" properties, poisoning the JavaScript object prototype chain. This affects all versions of mockjs up to and including 1.1.0. The attack requires network access if the application processes untrusted input through these functions, though it may also apply to direct code-level abuse. A patch is available via the denylist workaround provided by the advisory.

Affected products

  • nuysoft mockjs all versions up to 1.1.0

Timeline

  • 2023-12-08: disclosed
  • 2023-12-08: advisory: GHSA-mh8j-9jvh-gjf6 published

References