Executive brief
obx is a JavaScript library for state management and object manipulation. A prototype pollution vulnerability allows unauthenticated attackers to inject arbitrary properties into JavaScript objects, leading to arbitrary code execution and complete compromise of applications using vulnerable versions.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the obx library, affecting versions prior to 0.0.4. The flaw exists in multiple components including the reduce function, Object.set method, and the main build index.js file. Prototype pollution occurs when user-controlled input is improperly merged into object prototypes, allowing attackers to modify inherited properties. Since this is a JavaScript library vulnerability, exploitation requires that an application uses obx to process untrusted data. A successful exploit enables arbitrary code execution within the application's JavaScript runtime with no authentication required. The vulnerability was patched in version 0.0.4 as evidenced by commit 984ad92.
Affected products
- almela obx before 0.0.4
Timeline
- 2024-06-17: disclosed
- 2024-06-17: patched: Fixed in version 0.0.4