Executive brief
protobufjs is a JavaScript library for working with Protocol Buffer messages, widely used in web and Node.js applications. An attacker can exploit a prototype pollution vulnerability by providing maliciously crafted protobuf messages that overwrite core JavaScript object properties, potentially leading to arbitrary code execution, data manipulation, or denial of service in applications using the library.
Technical details
protobufjs versions 6.10.0–6.11.3 and 7.0.0–7.2.3 contain a prototype pollution vulnerability that allows attackers to pollute Object.prototype by crafting protobuf messages that exploit the parse(), load(), loadSync(), ReflectionObject.setParsedOption(), and util.setProperty() functions. The vulnerability stems from insufficient input validation when processing untrusted protobuf data; attackers can inject properties into Object.constructor.prototype to overwrite default behavior. The attack requires network reachability if the vulnerable parse function is exposed via an API, or may require user interaction if triggered through file loading. Patches are available in version 6.11.4 and 7.2.5 and later.
Affected products
- protobufjs protobufjs 6.10.0 through 6.11.3, 7.0.0 through 7.2.3
Timeline
- 2023-07-05: disclosed
- 2023-07-05: patched: Version 6.11.4 and 7.2.5 released with fix