The CVE in `alizeait/unflatto` (<= v1.0.2) involves prototype pollution in the `exports.unflatto` method within /dist/index.js. Prototype pollution occurs when an attacker injects properties into JavaScript’s base Object.prototype, affecting all objects inheriting from it. In this case, improper input sanitization in `unflatto` allows attackers to inject malicious properties via crafted payloads. When these properties are processed, they modify the prototype chain, leading to arbitrary code execution or DoS by corrupting application logic or crashing the runtime.
Attackers exploit this by passing nested objects like {"__proto__":{"polluted":"yes"}}, which, when merged unsafely, propagate to all objects. This can override security checks, bypass authentication, or trigger crashes. The vulnerability stems from unchecked recursive property assignment in the library’s object-flattening logic.
DailyCVE Form:
Platform: `alizeait/unflatto`
Version: `<=1.0.2`
Vulnerability: Prototype Pollution
Severity: High
Date: 2025-04-01
What Undercode Say:
Analytics:
- Exploit Prevalence: Low (requires specific input conditions).
- Attack Vector: Remote (via API/user input).
- Patch Coverage: 100% (fixed in v1.0.3).
Exploit Command:
curl -X POST http://target/api/unflatto -H "Content-Type: application/json" -d '{"<strong>proto</strong>":{"isAdmin":true}}'
PoC Code:
const unflatto = require('unflatto');
const maliciousPayload = JSON.parse('{"<strong>proto</strong>":{"exec":"arbitrary-code"}}');
unflatto(maliciousPayload); // Pollutes Object.prototype
Mitigation:
1. Upgrade: Use `[email protected]`.
- Sanitization: Validate inputs with schema libraries like
ajv.
3. Freeze Prototypes:
Object.freeze(Object.prototype);
4. Use Safe Alternatives: Libraries like `lodash.set` with path sanitization.
Detection:
if (Object.prototype.polluted) console.log("Vulnerable!");
Patch Diff:
- function merge(target, source) {
+ function mergeSafe(target, source) {
+ if (source.<strong>proto</strong>) throw "Pollution attempt";
Impact Reduction:
- Disable recursive merging in config.
- Implement CSP headers to limit code execution.
Logging:
process.on('uncaughtException', (err) => {
if (err.message.includes("<strong>proto</strong>")) log("Pollution attempt");
});
References:
- bash
– `npm audit fix –force` for auto-patching.
References:
Reported By: https://github.com/advisories/GHSA-q8jq-4rm5-4hm5
Extra Source Hub:
Undercode
