Prototype Pollution Vulnerability in Node-jszip Package
Summary
DEBIAN-CVE-2021-23413: This affects the package jszip before 3.7.0. Affects node-jszip versions < 3.5.0+dfsg-2. Fixed in 3.5.0+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node-jszip is a popular JavaScript library used for creating and manipulating zip files in Node.js applications. It allows developers to easily package files and manage zip archives. However, prior to version 3.7.0, the library was vulnerable to a prototype pollution issue, which could lead to unintended modifications of object prototypes, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from the ability to craft zip files with filenames that correspond to Object prototype values, such as proto or toString. This manipulation can result in a returned object that has a modified prototype instance, leading to unexpected behavior in the application. This issue can be exploited by attackers to inject malicious properties into objects, which may lead to further security vulnerabilities or application crashes.
How To Fix
Minimum fixed version
3.5.0+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-jszipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using zip files that contain filenames corresponding to Object prototype values. Additionally, ensure that any user-generated input is sanitized before processing it with the jszip library.
Conclusion
The prototype pollution vulnerability in the node-jszip package poses significant risks to applications that utilize this library. It is crucial for developers to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for node-jszip →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior or security issues.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software without requiring any installation.
If left unaddressed, this vulnerability could allow attackers to manipulate object prototypes, leading to unauthorized access, data corruption, or application crashes.
Yes, Vulert provides a service that monitors your application for open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and avoid processing zip files with potentially dangerous filenames as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-jszip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
