chbrown rfc6902 pointer.ts prototype pollution

Vulnerability

Description CVE-2021-4245 is a prototype pollution vulnerability identified in the chbrown/rfc6902 library, which implements RFC 6902 JSON Patch and RFC 6901 JSON Pointer in TypeScript [1]. The flaw resides in the pointer.ts file, where improper handling of specially crafted pointer paths can lead to modification of Object.prototype attributes [2]. This vulnerability is classified as problematic, with a patch reference c006ce9faa43d31edb34924f1df7b79c137096cf [3].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious JSON Patch operation that uses a crafted pointer path to manipulate the prototype of the base object. The exploit does not require authentication and can be triggered remotely if an application processes untrusted patch input [2]. The manipulation leads to prototype pollution, a technique where properties are injected into Object.prototype, affecting all objects inheriting from it.

Impact

Successful exploitation allows an attacker to inject arbitrary properties into the global Object prototype, potentially leading to property injection attacks or denial of service. In applications that use the library to apply patches to user-controllable objects, this could result in unexpected behavior, security bypasses, or further code execution depending on the application context [4]. The vulnerability has been disclosed publicly, increasing the risk of exploitation.

Mitigation

The recommended action is to apply the commit c006ce9faa43d31edb34924f1df7b79c137096cf from the upstream repository [3]. Users should update the rfc6902 library to a patched version. No workarounds have been officially documented; the safest mitigation is to upgrade the dependency [2].