Executive brief
@aofl/cli-lib is a Node.js command-line utility library used by developers to build CLI tools. The library contains a prototype pollution vulnerability in its defaultsDeep function that allows attackers to modify JavaScript object prototypes, potentially leading to denial of service, code execution, or privilege escalation in any application that uses the library with untrusted input.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the defaultsDeep function within the @aofl/cli-lib module (versions through 4.0.0-alpha.45). The function recursively merges properties from source objects to a destination object without validating or filtering special properties like __proto__ and constructor.prototype. An attacker can supply malicious JSON with __proto__ properties that, when processed by defaultsDeep, pollute the Object.prototype and affect all objects in the runtime. The attack requires the ability to control input passed to defaultsDeep, and can result in arbitrary behavior modification, DoS, or RCE depending on what properties are injected.
Affected products
- Age of Learning @aofl/cli-lib through 4.0.0-alpha.45
Timeline
- 2024-03-19: disclosed: Vulnerability reported on GitHub issue
- 2024-07-01: advisory: GHSA-vg6v-jcg3-5mp7 published