CVE-2022-21189: Prototype Pollution in Dexie
Summary
CVE-2022-21189: Prototype Pollution in Dexie. Affects dexie across 2 version ranges.
< 3.2.2
>= 4.0.0-alpha.1, < 4.0.0-alpha.3
Fixed in 3.2.2 or 4.0.0-alpha.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dexie is a minimalistic wrapper for IndexedDB, providing an easy-to-use interface for working with the browser's native database. It allows developers to perform CRUD operations on the client-side database, making it a popular choice for web applications that require offline data storage. Dexie versions before 3.2.2 and from 4.0.0-alpha.1 to 4.0.0-alpha.3 are vulnerable to a Prototype Pollution vulnerability in the Dexie.setByKeyPath(obj, keyPath, value) function. This vulnerability arises due to the lack of proper validation of keys being set, such as 'proto' or 'constructor'. Exploiting this vulnerability can enable an attacker to add or modify properties of the Object.prototype, leading to a prototype pollution vulnerability. It is important to note that this vulnerability can be triggered when modifying a collection with untrusted user input.
Vulnerability Detail
The Prototype Pollution vulnerability in Dexie allows an attacker to manipulate the prototype chain of objects, leading to unexpected behavior and potential security issues. By injecting malicious values into the 'keyPath' parameter of the Dexie.setByKeyPath() function, an attacker can modify properties of the Object.prototype. This can result in the execution of arbitrary code, privilege escalation, or the bypassing of security controls. The impact of this vulnerability depends on how the affected application utilizes Dexie and the sensitivity of the data stored in the IndexedDB.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.23.2.2npm install dexie@3.2.2 -
>= 4.0.0-alpha.1, < 4.0.0-alpha.34.0.0-alpha.3npm install dexie@4.0.0-alpha.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a secure version of Dexie is not immediately feasible, a possible workaround is to implement input validation and sanitization when using the Dexie.setByKeyPath() function. By ensuring that only trusted and properly validated values are used as 'keyPath' parameters, the risk of prototype pollution can be reduced. Here is an example of how input validation can be implemented in JavaScript:
function sanitizeKeyPath(keyPath) {
// Implement your input validation logic here
// Return the sanitized keyPath
}
const sanitizedKeyPath = sanitizeKeyPath(userInput);
dexie.setByKeyPath(obj, sanitizedKeyPath, value);
Conclusion
The Prototype Pollution vulnerability in Dexie can have serious security implications, allowing attackers to manipulate the prototype chain and potentially execute arbitrary code. It is crucial for developers to upgrade to the latest secure version of Dexie (3.2.2 or later) to mitigate this vulnerability. Implementing input validation and sanitization can provide an additional layer of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dexie →
FAQ
Dexie is a minimalistic wrapper for IndexedDB, providing an easy-to-use interface for working with the browser's native database.
Prototype Pollution is a vulnerability that allows an attacker to manipulate the prototype chain of objects, leading to unexpected behavior and potential security issues.
The vulnerability can be exploited by injecting malicious values into the 'keyPath' parameter of the Dexie.setByKeyPath() function, allowing an attacker to modify properties of the Object.prototype.
Exploiting this vulnerability can result in the execution of arbitrary code, privilege escalation, or the bypassing of security controls. The impact depends on how the affected application utilizes Dexie and the sensitivity of the data stored in the IndexedDB.
To mitigate this vulnerability, it is recommended to upgrade to Dexie version 3.2.2 or later. Additionally, implementing input validation and sanitization when using the Dexie.setByKeyPath() function can reduce the risk of prototype pollution.
