Prototype Pollution

Vulnerability

Overview

CVE-2020-7713 is a Prototype Pollution vulnerability in the npm package arr-flatten-unflatten. The issue exists in the constructor of the package, which allows an attacker to pollute the global Object.prototype by injecting properties through specially crafted input [1]. Prototype Pollution is a JavaScript vulnerability that occurs when properties like __proto__, constructor, or prototype can be modified, leading to inheritance of those properties across all objects in the application [3].

Exploitation and

Attack Surface

The attack can be executed by passing a malicious object to the unflatten function. For example, calling unflatten({'__proto__[polluted]': 'Yes! Its Polluted'}) modifies the __proto__ of the base object, thereby setting polluted on Object.prototype [4]. This action does not require authentication or special privileges, as it can be triggered by any input processed by the vulnerable function. The package is typically used in Node.js environments, making any application that uses arr-flatten-unflatten with untrusted data susceptible.

Impact

Successful exploitation can lead to several severe outcomes. It may cause denial of service by triggering JavaScript exceptions, or it can tamper with the application's source code to force code paths injected by the attacker, potentially resulting in remote code execution [3]. The pollution of Object.prototype affects all objects within the application, creating a widespread security risk.

Mitigation

The vulnerability affects all versions of the arr-flatten-unflatten package. A fix was implemented by the maintainer in response to a security report, which prevents modification of the object prototype [1][4]. The fix is available in the repository and should be applied by updating to the patched version. Users are strongly advised to update immediately, as the vulnerability is listed as a known security issue.