Executive brief
mockjs is a JavaScript library used to generate realistic test data and mock API responses during front-end development. A prototype pollution vulnerability in its core utility function allows attackers to modify or add properties to JavaScript's object prototype, which could interfere with application logic that relies on specific object attributes or break built-in functions.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the Util.extend function, which fails to validate object property names before assigning them. An attacker controlling input to Mock.Handler, Mock.Random, Mock.RE.Handler, or Mock.Util can exploit this by passing objects with "__proto__", "constructor", or "prototype" properties, poisoning the JavaScript object prototype chain. This affects all versions of mockjs up to and including 1.1.0. The attack requires network access if the application processes untrusted input through these functions, though it may also apply to direct code-level abuse. A patch is available via the denylist workaround provided by the advisory.
Affected products
- nuysoft mockjs all versions up to 1.1.0
Timeline
- 2023-12-08: disclosed
- 2023-12-08: advisory: GHSA-mh8j-9jvh-gjf6 published