CVE-2020-28480: Prototype pollution in JointJS

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

JointJS is an open-source JavaScript library for creating diagrams and visualizations. It provides a set of tools and features to build interactive diagrams in web applications. However, versions of JointJS prior to 3.3.0 are vulnerable to a Prototype Pollution attack. This vulnerability occurs in the util.setByPath function, which is used to access and set values in an object. The path used to access the object's key and set the value is not properly sanitized, allowing an attacker to manipulate the prototype of an object and potentially modify its behavior.

Vulnerability Detail

The vulnerability in JointJS allows an attacker to perform Prototype Pollution by manipulating the path parameter in the util.setByPath function. By injecting malicious input into the path, an attacker can modify the prototype of an object, leading to unexpected behavior or even remote code execution. This can have serious security implications, as it allows an attacker to bypass security controls, escalate privileges, or perform other malicious actions.

npm install jointjs@3.3.0

Workaround

If upgrading to the latest version is not immediately feasible, a possible workaround is to manually sanitize the input passed to the util.setByPath function. This can be done by validating and sanitizing the path parameter before using it to access or modify objects. Here is an example of how to sanitize the path parameter in JavaScript:

function sanitizePath(path) {
  // Implement path sanitization logic here
  return sanitizedPath;
}

const sanitizedPath = sanitizePath(userInputPath);
util.setByPath(object, sanitizedPath, value);

Conclusion

The JointJS library prior to version 3.3.0 is vulnerable to Prototype Pollution. This can allow an attacker to manipulate the prototype of an object and potentially execute arbitrary code. It is crucial to upgrade to the latest version of JointJS or apply proper input sanitization to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for jointjs →

FAQ