Executive brief
node-forge is a JavaScript library that implements TLS and cryptographic tools. The debug API in versions prior to 1.0.0 contained a prototype pollution vulnerability that could allow an attacker to modify core JavaScript object properties if untrusted input was passed to the API. However, the API was undocumented and used only internally for debugging purposes, making exploitation in real-world scenarios unlikely.
Technical details
This vulnerability is a prototype pollution issue (CWE-1321) in the forge.debug API. The vulnerable component fails to properly sanitize user-controlled input before using it to modify object prototype attributes in JavaScript. An attacker who can control input to the forge.debug API could inject properties into the Object prototype, potentially affecting all objects in the application. However, exploitation requires direct or indirect calls to the debug API with untrusted input. The forge.debug API was never documented or advertised as part of the public API and was only used for internal debugging purposes in a safe manner. The vulnerability was remedied by completely removing the forge.debug API and related functions in version 1.0.0.
Affected products
- Digital Bazaar node-forge < 1.0.0
Timeline
- 2022-01-08: disclosed: Advisory published on GitHub