Executive brief
@cdr0/sg is a JavaScript library used in Node.js applications for managing object references and properties. A prototype pollution vulnerability in version 1.0.10 allows attackers to manipulate the prototype chain through specially crafted input, potentially leading to arbitrary code execution, denial of service, or application logic bypass affecting all objects inheriting from the polluted prototype.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the @cdr0/sg library, specifically in the ref.js file at line 89. The vulnerability arises from improper handling of object property access, allowing attackers to inject properties into Object.prototype via the __proto__ or constructor.prototype special properties. An attacker can call the setOn() function with a crafted path like "__proto__.polluted" to pollute the root prototype. No authentication is required; the vulnerability is triggered through normal library function calls with malicious input. Successful exploitation can lead to remote code execution, denial of service, or cross-site scripting in affected applications. The issue affects all versions up to and including 1.0.10.
Affected products
- @cdr0 sg up to 1.0.10
Timeline
- 2024-03-03: disclosed
- 2024-06-17: advisory