hughsk flat index.js unflatten prototype pollution

Vulnerability

Overview

The unflatten function in the index.js file of the hughsk/flat npm package (versions up to and including 5.0.0) is vulnerable to prototype pollution [1]. This occurs because the function does not properly sanitize user-controlled input, allowing an attacker to inject properties that modify Object.prototype [1]. Prototype pollution is a type of security flaw where an attacker can manipulate the prototype of a base object, potentially affecting all objects in a JavaScript runtime environment.

Attack

Vector and Exploitation

The vulnerability can be triggered remotely, meaning an attacker does not need local access to the system [1]. Exploitation typically involves crafting a nested object payload that, when processed by unflatten, sets a property such as __proto__.polluted to a desired value. The attack has a low attack complexity and does not require high privileges or user interaction [1]. Applications that accept untrusted input and pass it to the vulnerable unflatten function are at risk.

Impact

Successful exploitation allows an attacker to override existing properties or add new properties to Object.prototype [1]. This can lead to a variety of security consequences, including modification of application behavior, bypass of security checks, denial of service, or in some cases, arbitrary code execution depending on how the application uses the affected objects. The vulnerability is classified as critical due to the potentially severe impact on the entire application's object model.

Mitigation

The vulnerability has been addressed in version 5.0.1 of the flat package [1]. The fix was implemented via commit 20ef0ef55dfa028caddaedbcb33efbdb04d18e13 [1]. Users are strongly recommended to upgrade to version 5.0.1 or later. For those unable to upgrade, a workaround involves sanitizing input before passing it to the unflatten function, such as by filtering out keys that begin with __proto__, constructor, or prototype. The vulnerability is tracked as VDB-216777.