CVE-2023-45827: Prototype Pollution vulnerability in @clickbar/dot-diver

Background

The @clickbar/dot-diver package is an npm package that provides utility functions for working with nested objects in JavaScript. It includes functions like getByPath and setByPath, which allow users to access and modify nested object properties using dot notation. This package is widely used in JavaScript applications for handling complex data structures.

Vulnerability Detail

The vulnerability identified in @clickbar/dot-diver is a Prototype Pollution (PP) vulnerability in the setByPath function. Prototype Pollution is a type of vulnerability that allows an attacker to modify the prototype of an object, leading to potential remote code execution (RCE) or denial of service (DoS) attacks. In the vulnerable code snippet, there is no validation for Prototype Pollution, allowing an attacker to pollute the prototype of an object by setting a malicious value. This can have severe consequences depending on how the polluted object is used in the application.

npm install @clickbar/dot-diver@1.0.2

Workaround

As a temporary workaround, users can avoid using the setByPath function or any other functions that directly manipulate object prototypes. Instead, they can manually handle object property assignments using safe and validated methods. Here's an example of a workaround:

const objectToSet = {};
const lastKey = 'polluted';
const value = 'foo';

// Perform proper validation and sanitization checks
if (typeof objectToSet === 'object' && lastKey !== '__proto__') {
  objectToSet[lastKey] = value;
}

Conclusion

The Prototype Pollution vulnerability in @clickbar/dot-diver can have severe consequences, including remote code execution and denial of service attacks. It is crucial to update the package to the latest version (1.0.2 or later) to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for @clickbar/dot-diver →

FAQ