UnratednpmAmendedPublished
Prototype pollution in emit function
GHSA-82jv-9wjw-pqh6
- Affected
- npm derby <= 2.3.1; >= 3.0.0, <= 3.0.1; >= 4.0.0-beta1, <= 4.0.0-beta.10
- Fixed in
- 4.0.0-beta.113.0.22.3.2· Vendor fix available
- Issue
- A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key. Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications. Details The emit() function in src/templates/templates.ts is called without sanitizing the variable this.lastSegment . The variable this.lastSegment can be set to proto, and this will pollute the prototype of Javascipt Object (node['proto'] = target). PoC To reproduce this vulnerability, you can adjust the test case ignores DOM mutations in components\' create() in test/dom/ComponentHarness.mocha.js. When as attribute is controlled by attackers, the variable in this.lastSegment will exactly take value proto and prototype pollution happens. Patch Add a check on this.lastSegment can prevent this attack.
Recommended action: Upgrade to 4.0.0-beta.11 (pre-release), 3.0.2 or 2.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.