CVE-2021-3766: objection.js Prototype Pollution vulnerability
Summary
CVE-2021-3766: objection.js Prototype Pollution vulnerability. Affects objection versions < 2.2.16. Fixed in 2.2.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
objection.js is an npm package that provides an easy-to-use interface for interacting with databases using the Knex query builder. It simplifies database operations and allows developers to work with JavaScript objects instead of writing raw SQL queries. However, objection.js prior to version 2.2.16 is vulnerable to a Prototype Pollution vulnerability. This vulnerability allows an attacker to modify the prototype of an object, leading to potential security issues.
Vulnerability Detail
The vulnerability in objection.js arises from improper control over the modification of object prototype attributes, also known as 'Prototype Pollution'. By manipulating the prototype of an object, an attacker can introduce or modify properties and methods that may be used by the application. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service attacks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.2.16
This is the first release that contains the fix.
npm install objection@2.2.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version to mitigate the risk.
Conclusion
objection.js prior to version 2.2.16 is vulnerable to a Prototype Pollution vulnerability. To mitigate the risk, it is crucial to upgrade objection.js to version 2.2.16 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for objection →
FAQ
objection.js is an npm package that simplifies database operations and allows developers to work with JavaScript objects instead of writing raw SQL queries.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to potential security issues.
The consequences of this vulnerability can vary depending on the attacker's intentions. It can lead to remote code execution, information disclosure, or denial of service attacks.
To fix this vulnerability, it is recommended to upgrade objection.js to version 2.2.16 or later.
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
