CVE-2021-43138: Prototype Pollution in async

Background

The async package is a popular npm package that provides utilities for working with asynchronous JavaScript. It offers functions for managing control flow, handling errors, and working with collections. The package is widely used in Node.js and browser environments. However, versions up to 3.2.1 for 3.x and up to 2.6.3 for 2.x are vulnerable to a prototype pollution vulnerability in the mapValues() method.

Vulnerability Detail

The vulnerability allows a malicious user to exploit the mapValues() method in the async package to gain elevated privileges. By manipulating the input to the method, an attacker can modify the prototype of objects, leading to potential code execution or privilege escalation. This can have severe consequences, such as unauthorized access to sensitive data or the ability to execute arbitrary code.

npm install async@3.2.6

Workaround

As a temporary workaround, developers can avoid using the mapValues() method in the async package or implement input validation and sanitization to prevent malicious input from being processed. Here is an example of input validation for the mapValues() method:

const async = require('async');

function validateInput(obj) {
  // Perform input validation here
  // Return the sanitized object
}

const input = { key: 'value' };
const sanitizedInput = validateInput(input);

async.mapValues(sanitizedInput, (value, key, callback) => {
  // Process the sanitized input
  callback(null, value);
}, (err, result) => {
  if (err) {
    // Handle error
  } else {
    // Handle result
  }
});

Conclusion

In conclusion, the async package is vulnerable to prototype pollution in the mapValues() method. Developers should upgrade to the latest non-vulnerable version of the package (3.2.2 for 3.x and 2.6.4 for 2.x) to mitigate the risk. Input validation and sanitization can also be implemented as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for async →

FAQ