Executive brief
A security vulnerability exists in the @andrei-tatar/nora-firebase-common library, which is used for integrating smart home devices with Firebase. An attacker can exploit this flaw to remotely execute unauthorized code on systems using the library. This could lead to a complete takeover of the affected service, potentially exposing sensitive user data or disrupting smart home operations.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in @andrei-tatar/nora-firebase-common between versions 1.0.41 and 1.12.2. The flaw is located in the updateStateInternal method, where the updateState parameter is not properly validated. A remote, unauthenticated attacker can provide a specially crafted script or object that modifies the JavaScript object prototype. This modification can be leveraged to achieve remote code execution (RCE) in the context of the application. The issue has been addressed in version 1.12.3.
Affected products
- andrei-tatar @andrei-tatar/nora-firebase-common >= 1.0.41, < 1.12.3
Timeline
- 2024-04-18: disclosed
- 2024-04-18: advisory
- 2024-04-18: patched: Version 1.12.3 released
References
- https://api.github.com/users/TheeCryptoChad
- https://github.com/TheeCryptoChad
- https://api.github.com/users/TheeCryptoChad/gists%7B/gist_id%7D
- https://api.github.com/users/TheeCryptoChad/repos
- https://avatars.githubusercontent.com/u/54559164?v=4
- https://api.github.com/users/TheeCryptoChad/events%7B/privacy%7D