Prototype pollution in dojo

CVE-2020-5258 is a Prototype Pollution vulnerability in the dojo JavaScript toolkit (NPM package), specifically in the deepCopy method. Prototype Pollution occurs when an attacker can inject properties into existing JavaScript object prototypes, allowing them to overwrite or pollute the base object prototype [1][3]. The root cause is that deepCopy does not sanitize the __proto__ property, enabling the malicious payload to propagate.

To exploit this vulnerability, an attacker supplies a crafted JSON object containing a __proto__ property with a malicious payload. When deepCopy processes this object, it copies the __proto__ property into the prototype chain of the target object, effectively polluting all objects in the application [3]. The attack requires the ability to pass malicious input to the deepCopy method, but no authentication is needed if the input originates from an untrusted source.

Successful exploitation allows the attacker to add arbitrary properties to the global Object.prototype. This can lead to unexpected behavior in the application, such as bypassing security checks, property overwrites, or denial of service, depending on how the polluted properties are used [1]. The impact is broad because the pollution affects all objects that inherit from the polluted prototype.

This vulnerability has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2, as well as in the earlier 1.11.10 release [1][3][4]. Users should upgrade to a patched version immediately. There is no workaround short of patching, as the fix specifically sanitizes the __proto__ property during deep copy operations [4].