CVE-2024-38997

Vulnerability

Overview A prototype pollution vulnerability exists in @adolph_dudu/ratio-swiper version 0.0.2 within the extendDefaults function. The flaw allows an attacker to inject arbitrary properties into the global Object.prototype by passing a specially crafted object containing the __proto__ key [1][2][3]. This is a classic prototype pollution pattern that can have severe security implications.

Exploitation

An attacker can exploit this vulnerability by calling the extendDefaults or parse methods with a JSON object that includes "__proto__": { ... }. The provided proof-of-concept demonstrates that after such a call, the prototype of all objects is polluted, as shown by the addition of a new property to Object.prototype [3]. No authentication or special network position is required; the attack can be triggered by any code that processes user-controlled input through the vulnerable functions.

Impact

Successful exploitation can lead to multiple outcomes depending on the application context. The attacker can alter the behavior of all objects inheriting from the polluted prototype, potentially leading to Denial of Service (DoS), arbitrary code execution, or cross-site scripting (XSS) if the application uses the polluted properties in security-sensitive ways [2][3]. The CVSS v3.1 score is 6.5 (Medium) [3].

Mitigation

As of the advisory date, the vendor has not released a patch for this vulnerability. Users should consider updating to a patched version if available, or implement input sanitization to prevent __proto__ keys from being processed by the affected functions. The package may be at risk of being added to the CISA Known Exploited Vulnerabilities catalog if exploitation becomes widespread.