Executive brief
think-config is a configuration management library used in ThinkJS applications. The library fails to properly validate user-supplied input when updating configuration object attributes, allowing attackers to pollute the JavaScript object prototype. This could enable attackers to modify fundamental object behaviors or inject malicious code into all application objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in think-config versions before 1.1.3. The library accepts input from upstream components that specify object attributes to initialize or update, but does not properly restrict modifications to the object prototype itself. An attacker can craft malicious input that modifies prototype attributes, potentially affecting the behavior of all objects in the application. The vulnerability is network-reachable if the application exposes configuration input endpoints. The fix is available in version 1.1.3 and later.
Affected products
- thinkjs think-config < 1.1.3
Timeline
- 2021-07-24: disclosed
- 2021-08-03: patched: Fixed in version 1.1.3