Executive brief
fast-loops is a lightweight JavaScript library used for high-performance data iteration and object manipulation. A security flaw in the library allows an attacker to inject malicious properties into shared JavaScript objects. This can lead to application crashes, unpredictable behavior, or potentially allow unauthorized code execution depending on how the application uses the library.
Technical details
A prototype pollution vulnerability exists in the 'objectMergeDeep' function of the fast-loops library (v1.1.3 and earlier). The function fails to properly sanitize or restrict sensitive object keys such as '__proto__', 'constructor', and 'prototype' during deep merge operations. An attacker can exploit this by providing a specially crafted object that modifies the base Object prototype. This can result in the injection of arbitrary properties across all objects in the application, which may be leveraged for Denial of Service (DoS) or Remote Code Execution (RCE) depending on the application's environment. The issue is fixed in version 1.1.4.
Affected products
- robinweser fast-loops <= 1.1.3
Timeline
- 2024-07-01: disclosed
- 2024-07-01: advisory
- 2024-07-10: patched