Executive brief
Derby is a real-time web application framework that uses templates to build dynamic user interfaces. A prototype pollution vulnerability in the emit function can crash an application if template authors allow user input to control HTML element attribute names. While most applications protect against this by using hardcoded attribute names, an attacker exploiting this in a vulnerable setup could disrupt service availability or potentially influence application behavior.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321) in the emit() function in src/templates/templates.ts. The function assigns values to object keys without sanitizing the key name (this.lastSegment), allowing an attacker to set keys to reserved JavaScript properties like '__proto__' via the HTML template's 'as' attribute. When this.lastSegment is set to '__proto__', the assignment node['__proto__'] = target pollutes the JavaScript Object prototype. The attack requires atypical template design where the 'as' attribute is controlled by user input. The fix, released in versions 2.3.2, 3.0.2, and 4.0.0-beta.11, adds validation to reject keys containing '__proto__' or 'prototype'.
Affected products
- Derby Derby <= 2.3.1, <= 3.0.1, <= 4.0.0-beta.10
Timeline
- 2024-04-17: disclosed
- 2024-04-17: patched: Versions 2.3.2, 3.0.2, and 4.0.0-beta.11 released