Executive brief
dot-diver is a JavaScript utility library for manipulating nested object properties. A prototype pollution vulnerability in the setByPath function allows an unauthenticated attacker to modify the JavaScript Object prototype without input validation. This can lead to denial of service, remote code execution, or unauthorized access to sensitive data across any application using this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the setByPath function, which fails to validate input paths before assigning values to object properties. An attacker can exploit this by passing a crafted path such as "constructor.prototype.polluted" to inject arbitrary properties into the Object prototype. The attack requires no authentication or user interaction and is network-reachable if the application exposes the setByPath function via an API or accepts user-controlled input. A successful exploit can pollute the prototype chain, affecting all object instances in the application and potentially enabling remote code execution. The vulnerability is fixed in version 1.0.2 and later.
Affected products
- clickbar dot-diver < 1.0.2
Timeline
- 2023-11-03: disclosed: Advisory published
- 2023-11-03: patched: Fixed in version 1.0.2