CVE-2023-26113

The vulnerability affects collection.js versions before 6.8.1, a JavaScript library for working with collections. The flaw exists in the extend function located in Collection.js/dist/node/iterators/extend.js. This function is used for merging or extending objects. Due to improper handling of recursive property definitions, it allows an attacker to inject properties into the prototype chain via __proto__ or similar attributes, a classic Prototype Pollution pattern [1][2].

Exploitation

An attacker can exploit this by providing a crafted source object that includes a property like __proto__ (or constructor/prototype) with nested properties. When the extend function recursively merges properties, it traverses into the prototype of the base object, thereby polluting Object.prototype. This requires the attacker to control the input to the extend function (e.g., through user-supplied JSON data that is later merged). No additional authentication is needed if the application processes attacker-controlled data through this function [1][2].

Impact

Successful Prototype Pollution can lead to: - Denial of Service (DoS): By polluting prototypes with properties that cause exceptions during object operations. - Remote Code Execution (RCE): By tampering with property values that affect application logic, potentially altering code paths to execute arbitrary code. This typically requires chaining with other application-specific logic that reads properties from objects (e.g., options or config) [2].

Mitigation

The vulnerability is patched in version 6.8.1 of collection.js, released on 2023-01-30 [3]. Users should update to this version or later. No known workarounds have been documented, but sanitizing user input to prevent __proto__ entries before calling extend could reduce risk in legacy applications.