Executive brief
The hoolock JavaScript library provides utility functions for accessing and modifying object properties, commonly used in application code. Due to inadequate validation, attackers could exploit prototype pollution to modify core JavaScript object prototypes, potentially affecting the behavior of all objects in an application and leading to unexpected data modification or denial of service.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the get, set, and update functions of the hoolock utility library. These functions failed to validate that user-supplied property paths were not targeting the object prototype chain, allowing attackers to access or modify Object.prototype and other inherited properties. The attack requires user input that is processed through one of these vulnerable functions; no authentication is required. A successful exploit could allow an attacker to pollute prototypes and alter application behavior across all objects. The vulnerability was remediated in version 2.2.1 by adding explicit checks that throw a TypeError when inherited properties are accessed or modified.
Affected products
- elijahharry hoolock >=2.0.0, <2.2.1
Timeline
- 2024-01-23: disclosed: GHSA-4c2g-hx49-7h25 published
- 2024-01-23: patched: Fix released in version 2.2.1