CVE-2021-23507: Prototype Pollution in object-path-set
Summary
CVE-2021-23507: Prototype Pollution in object-path-set. Affects object-path-set versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package object-path-set is an npm package that provides a utility for setting values in nested JavaScript objects using a path string. It is commonly used in JavaScript applications to manipulate and modify object properties. However, versions of object-path-set before 1.0.2 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to merge object prototypes into the setPath method, potentially leading to unauthorized access, data manipulation, or remote code execution.
Vulnerability Detail
The vulnerability in object-path-set arises from the setPath method, which does not properly sanitize user input. An attacker can exploit this by injecting malicious input that modifies the prototype of the target object. This can lead to various security issues, such as unauthorized access to sensitive data, modification of object behavior, or execution of arbitrary code. The incomplete fix in a previous version of the package contributes to the persistence of this vulnerability.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install object-path-set@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, developers can implement input validation and sanitization measures to mitigate the risk of Prototype Pollution. This can involve implementing strict input validation checks, using safe alternatives for object manipulation, or employing security libraries specifically designed to prevent Prototype Pollution attacks.
Conclusion
The Prototype Pollution vulnerability in object-path-set poses a significant risk to applications utilizing this package. It is crucial to upgrade to version 1.0.2 or later to ensure the complete fix for this vulnerability. Implementing input validation and sanitization measures can provide temporary mitigation until the upgrade is performed. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for object-path-set →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security issues. It is commonly exploited to bypass security controls, access sensitive data, or execute arbitrary code.
The Prototype Pollution vulnerability in object-path-set allows an attacker to modify the prototype of the target object by injecting malicious input through the setPath method. This can lead to unauthorized access, data manipulation, or remote code execution.
The impact of this vulnerability depends on the context in which object-path-set is used. It can potentially lead to unauthorized access to sensitive data, modification of object behavior, or execution of arbitrary code. The severity of the impact may vary based on the privileges and access level of the affected application.
Yes, the vulnerability has been fixed in version 1.0.2 of the object-path-set package. It is recommended to upgrade to this version or later to ensure the mitigation of the Prototype Pollution issue.
If immediate upgrading is not possible, developers can implement input validation and sanitization measures to mitigate the risk of Prototype Pollution. This involves implementing strict input validation checks, using safe alternatives for object manipulation, or employing security libraries specifically designed to prevent Prototype Pollution attacks.
