CVE-2021-20085: Prototype Pollution in backbone-query-parameters
Summary
CVE-2021-20085: Prototype Pollution in backbone-query-parameters. Affects backbone-query-parameters versions < 0.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
backbone-query-parameters is an npm package that provides functionality for managing query parameters in Backbone.js applications. It allows users to easily manipulate and retrieve query parameters from the URL. However, version 0.4.0 of backbone-query-parameters is vulnerable to Prototype Pollution, a type of vulnerability where an attacker can inject properties into Object.prototype. This can lead to various security issues and unexpected behavior in applications that use this package.
Vulnerability Detail
The vulnerability in backbone-query-parameters arises from improper control over the modification of Object Prototype Attributes, also known as Prototype Pollution. An attacker can exploit this vulnerability to inject malicious properties into Object.prototype, which can then be accessed and manipulated by other parts of the application. This can result in a range of security issues, including remote code execution, information disclosure, and denial of service attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a non-vulnerable version of backbone-query-parameters to mitigate the risk.
Conclusion
The Prototype Pollution vulnerability in backbone-query-parameters can have severe consequences for applications that use this package. It is crucial to upgrade to a non-vulnerable version, starting from version 0.4.0. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for backbone-query-parameters →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and security issues in the application.
An attacker can exploit this vulnerability by injecting malicious properties into Object.prototype, which can then be accessed and manipulated by other parts of the application.
The consequences of this vulnerability can vary depending on how it is exploited. Possible outcomes include remote code execution, information disclosure, and denial of service attacks.
Yes, upgrading to a version of backbone-query-parameters that is not affected by this vulnerability will fix the issue.
No, there are no known workarounds for this vulnerability. Upgrading to a non-vulnerable version is the recommended solution.
