Executive brief
flatten-json is a popular Node.js library used to convert flat objects into nested structures. A prototype pollution vulnerability in the unflattenJSON function allows attackers to inject malicious properties into JavaScript objects, potentially leading to denial of service, application crashes, or code execution depending on how the application uses the affected library.
Technical details
A prototype pollution vulnerability exists in the unflattenJSON function (index.js:42) where user-supplied object properties are unsafely assigned to the destination object without sanitization. An attacker can exploit this via specially crafted input containing __proto__ or constructor.prototype keys to pollute the Object.prototype chain. This vulnerability requires the application to call unflattenJSON with untrusted input; no authentication is required. Successful exploitation can lead to denial of service or remote code execution depending on the application's use of the polluted object properties. No patch has been released by the maintainer; users are advised to implement input validation blocking __proto__ and constructor.prototype patterns.
Affected products
- Allan Lancioni flatten-json 1.0.1 and earlier
Timeline
- 2024-06-17: disclosed: Vulnerability published in GitHub Advisory Database
- 2024-06-17: other: CVE-2024-36574 assigned