Executive brief
AppHP's object-resolver is a JavaScript library for manipulating nested object properties. A prototype pollution vulnerability in the setNestedProperty function allows attackers to inject malicious properties into JavaScript object prototypes, potentially compromising the behavior of any application using this library and affecting data integrity or enabling privilege escalation.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the Module.setNestedProperty function of @apphp/object-resolver versions before 3.1.1. The function failed to properly validate path inputs, allowing attackers to set properties on Object.prototype or other built-in prototypes via special key sequences (e.g., "__proto__", "constructor", "prototype"). An attacker with the ability to control the path parameter can pollute the prototype chain, affecting all objects in the application. The attack vector is network-based if the library processes untrusted user input. The vulnerability was fixed in version 3.1.1 via commit 7e347a2, which added type checking and validation for the path parameter.
Affected products
- AppHP object-resolver < 3.1.1
Timeline
- 2024-06-17: disclosed
- 2024-04-06: patched: Fix committed; version 3.1.1 released