Executive brief
Bun, a JavaScript runtime and toolkit, contains a prototype pollution vulnerability in its native API layer that accepts objects as input. An authenticated attacker can exploit this to pollute object prototypes, potentially leading to code execution or unauthorized data access. The vulnerability affects all versions before 1.1.30 and has been patched.
Technical details
The vulnerability is an application-level prototype pollution (CWE-1321) caused by improper input sanitization in Bun's runtime native APIs when processing objects. The root cause is that the API consults prototype chains when accessing object properties, allowing attackers to inject malicious properties into Object.prototype. This requires an authenticated user with network access to an application using affected Bun APIs. An attacker can exploit this through APIs that accept objects to pollute shared prototypes and affect application behavior, potentially escalating privileges or modifying data. The fix (merged in PR #14119) involves ignoring prototype chains when calling getters on objects in most natively-implemented APIs, with patches available in version 1.1.30 and later.
Affected products
- Oven Bun before 1.1.30
Timeline
- 2024-12-18: disclosed
- 2024-09-25: patched: Fix merged in PR #14119; patch version 1.1.30