CVE-2021-23624: Prototype Pollution in dotty
Summary
CVE-2021-23624: Prototype Pollution in dotty. Affects dotty versions < 0.1.2. Fixed in 0.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dotty package is an npm package that provides functionality for manipulating and working with JavaScript objects. It is commonly used for tasks such as object traversal, manipulation, and data extraction. However, the package is vulnerable to a prototype pollution vulnerability in versions before 0.1.2.
Vulnerability Detail
The vulnerability arises due to a type confusion issue that can bypass the fix for CVE-2021-25912. When user-provided keys used in the path parameter are arrays, an attacker can exploit this vulnerability to manipulate the prototype of objects, leading to potential security breaches. This can result in unauthorized access, data manipulation, or remote code execution.
How To Fix
Minimum fixed version
0.1.2
This is the first release that contains the fix.
npm install dotty@0.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk of exploitation.
Conclusion
In conclusion, the dotty package is vulnerable to a prototype pollution issue that can lead to unauthorized access, data manipulation, or remote code execution. It is crucial to update to version 0.1.2 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dotty →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security breaches.
CVE-2021-25912 is a related vulnerability that can be bypassed by the type confusion issue in dotty. It is important to address both vulnerabilities to ensure the security of the application.
An attacker can exploit this vulnerability by providing malicious input in the form of arrays as user-provided keys in the path parameter. This can lead to the manipulation of object prototypes and potential security breaches.
No, only versions before 0.1.2 are affected by this vulnerability. It is recommended to update to the latest version to mitigate the risk.
Yes, the CVSS score for this vulnerability is 5.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dotty.
