Prototype Pollution Vulnerability in dset

Background

dset is an npm package that provides a utility function for setting nested properties in JavaScript objects. It allows developers to easily manipulate and modify object properties. However, versions 1.0.0 through 2.0.1 of dset are vulnerable to a prototype pollution attack.

Vulnerability Detail

The vulnerability in dset arises from a lack of validation in the 'export()' function. This function does not check the type of object before assigning a value to a property. As a result, an attacker can exploit this flaw to create a non-existent property or manipulate existing properties, leading to denial of service or potential remote code execution. By supplying a malicious value through the 'keys' argument, an attacker can pollute the object prototype and potentially bypass security checks.

npm install dset@2.0.1

Workaround

If updating to a fixed version of dset is not immediately possible, a workaround can be implemented by manually validating the 'keys' argument before calling the 'export()' function. This can be done by checking if the 'keys' value includes any potentially dangerous properties, such as 'proto'. If such properties are detected, the function should reject the input and prevent the pollution of the object prototype. Here is an example of a workaround implementation:

const dset = require('dset');

function safeExport(obj, keys, val) {
  if (keys.includes('__proto__')) {
    throw new Error('Invalid keys');
  }
  dset(obj, keys, val);
}

var obj = {};
console.log('Before:', obj.isAdmin);
safeExport(obj, '__proto__.polluted', true);
console.log('After:', obj.polluted);

Conclusion

The prototype pollution vulnerability in dset versions 1.0.0 through 2.0.1 can have serious consequences, including denial of service and potential remote code execution. It is crucial to update to a fixed version of dset (2.0.2 or later) as soon as possible. If immediate updating is not feasible, implementing the provided workaround can help mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for dset →

FAQ