CVE-2021-26505

Vulnerability

Overview The hello.utils.extend function in MrSwitch hello.js version 1.18.6 is vulnerable to prototype pollution [1][3]. This function recursively merges properties from source objects into a target object but fails to filter dangerous keys such as __proto__ or constructor. An attacker can inject malicious properties into the global Object prototype, which can lead to arbitrary code execution [2][3].

Exploitation

To exploit this vulnerability, an attacker must supply a crafted object to the hello.utils.extend function, either directly or through user-supplied input that is later merged by the library [1]. The attack requires no authentication if the function is exposed client-side in a web application. The recursive merge logic does not check for prototype chain properties, allowing the attacker to pollute Object.prototype with injected methods or properties [3].

Impact

A successful prototype pollution attack can enable remote code execution, cross-site scripting (XSS), or other client-side attacks [3]. By polluting the prototype, the attacker can override default behavior of objects used throughout the application, potentially leading to arbitrary code execution in the browser context [2].

Mitigation

The issue has been fixed in the hello.js repository by adding a check that skips keys __proto__ and constructor during the merge [4]. Users should upgrade to a patched version (v1.18.7 or later) or apply the fix manually by using the updated extend function [1][4].