Prototype Pollution

The vulnerability resides in the set function of the total.js framework prior to version 3.4.7. This function is used to assign a value to an object property based on a given path. However, the keys in the path are not properly sanitized, allowing an attacker to manipulate special properties such as __proto__, constructor, or prototype. This leads to prototype pollution, where the attacker can inject properties into the base Object prototype [1].

Exploitation requires the ability to invoke the set function with a crafted path string. No special authentication is needed if the function is exposed to user input. The attacker can pollute Object.prototype globally, affecting all JavaScript objects in the application. For example, by setting __proto__.isAdmin to true, the attacker might bypass authorization checks. The Snyk advisory explains that property definition by path is a common vector for prototype pollution [2].

The impact varies by application, but in many cases prototype pollution can lead to Denial of Service (DoS) by triggering exceptions, Remote Code Execution (RCE) by altering code execution paths, or Property Injection. The NVD description notes that the impact depends on the application [1].

The issue was fixed in total.js version 3.4.7. The commit [3] shows that a check was added to reject paths containing __proto__, constructor, or prototype, throwing an error to prevent pollution. Users should upgrade to the latest version to mitigate the risk.