Executive brief
A vulnerability exists in the @hapi/hoek utility library, which provides general-purpose helper functions for Node.js applications. An attacker can provide specially crafted data that modifies the base behavior of all objects within the application. This could potentially lead to application crashes or, in rare and specific configurations, allow for unauthorized code execution.
Technical details
The @hapi/hoek library is vulnerable to prototype pollution (CWE-1321) within its `clone` function. The function fails to properly sanitize or restrict the modification of the `Object.prototype` when processing specially crafted input. An attacker can exploit this by injecting properties into the global object prototype, which are then inherited by all objects in the Node.js environment. While the hapi framework itself includes protections against this, standalone usage of the library is at risk. Depending on the application's logic, this can result in Denial of Service (DoS) or Remote Code Execution (RCE). The issue is resolved in versions 8.5.1 and 9.0.3.
Affected products
- hapi @hapi/hoek >= 8.3.2, < 8.5.1
- hapi @hapi/hoek >= 9.0.0, < 9.0.3
Timeline
- 2020-08-31: patched: Fixes released in versions 8.5.1 and 9.0.3
- 2020-09-04: disclosed: Advisory published on GitHub/OSV