Executive brief
klona is a JavaScript library used for deep cloning objects in web applications. Versions before 1.1.1 contained a prototype pollution vulnerability that could allow an attacker to inject malicious properties affecting all objects in the application, potentially leading to unexpected behavior, data manipulation, or security bypass depending on how the application uses cloned objects.
Technical details
klona is vulnerable to prototype pollution (CWE-1321) due to insufficient validation when cloning objects. The vulnerability exists because the package does not properly restrict modifications to an Object's prototype during the cloning process. An attacker can craft a malicious input that, when cloned by klona, pollutes the prototype chain and adds or modifies properties that will exist on all subsequently created objects in the JavaScript runtime. This is a network-reachable vulnerability if user-controlled data is passed to klona's clone functions. The vulnerability was fixed in version 1.1.1.
Affected products
- klona klona < 1.1.1
Timeline
- 2020-09-04: disclosed
- 2020-08-31: patched: Fix available in version 1.1.1