Prototype Pollution

Vulnerability

CVE-2020-28458 is a Prototype Pollution vulnerability in the npm package datatables.net, affecting all versions. It arises from an incomplete fix for a previous vulnerability (SNYK-JS-DATATABLESNET-598806) [1]. The package improperly sanitizes user-controlled input, allowing the injection of properties like constructor into the object prototype.

Exploitation

An attacker can exploit this by providing crafted data that includes a constructor property with a prototype property. When DataTables processes this data during table initialization or data update, it merges the attacker's input into the package's internal objects, polluting the global Object prototype [2]. No authentication is required if the application uses user-supplied data (e.g., from JSON or URL parameters).

Impact

Prototype Pollution allows an attacker to add or modify properties of all objects in the application. This can lead to privilege escalation, denial of service, or arbitrary code execution depending on how the affected properties are used by the application [4]. The vulnerability has a CVSS score of 7.5 (High) [1].

Mitigation

Users should upgrade to datatables.net version 1.10.25 or higher, which contains the complete fix [4]. No known workarounds exist, and the package maintainers have addressed the issue in the commit [2].