The @fabiocaccamo/utils.js is a package that provides methods with multiple functions for the convenience of developers. A vulnerability exists in one method included in this package.
I discovered a prototype pollution vulnerability via utils.js method analysis. In the 0.17.1 version package, Prototype Pollution occurs because the key value of the object is not checked within the set() method.
set: function(obj, path, value)
If you check the set() method of utils.object.keypath, you can see that the value of the path parameter is split with dots, and then merged with the value of the value parameter based on the key value.
const utils = require("@fabiocaccamo/utils.js");
I wrote PoC as above!
A prototype pollution vulnerability has occurred and you can see the object being polluted. I first found a prototype pollution in node module. this is my favourite vulnerability. So I’m very happy that I found it!
Also, the vulnerability has been patched, so i have been assigned CVE-2021-3815 for this vulnerability! This is my first CVE.
var cursor = obj;
- 2021-11-30 21h 11m : Reported this issue via the huntr
- 2021-12-02 17h 24m : Validated this issue by Fabio Caccamo
- 2021-12-06 19h 46m : Patched this issue by Fabio Caccamo
- 2021-12-07 23h 57m : Requested a CVE for this issue by Jamie Slome
- 2021-12-09 12h 25m : Assigned the CVE-2021-3815