Executive brief
The bunt library is a JavaScript framework/utility package used in Node.js applications for parsing query strings and managing application logic. A prototype pollution vulnerability in its query string parser allows attackers to inject malicious properties that affect all objects in an application, potentially leading to arbitrary code execution, denial of service, or cross-site scripting attacks.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the @bunt/util package's query string parser component (/esm/qs.js). The vulnerability exists because the parser unsafely merges user-supplied input into objects without proper validation, allowing attackers to manipulate the __proto__ or constructor.prototype properties. An attacker can inject specially crafted query strings or JSON payloads to pollute Object.prototype, affecting the behavior of all objects that inherit from it. The attack requires network access and no authentication, and can result in remote code execution. The vulnerability was fixed in version 0.29.26; all versions prior to that are affected.
Affected products
- izatop bunt 0.0.0 through 0.29.25
Timeline
- 2024-08-12: disclosed: Vulnerability published in GitHub Advisory Database and NVD
- 2024-08-13: patched: Fix released in version 0.29.26; commit c55201a8cee03e5282f99874dead988c80d31db7