CVE-2020-5259

Overview

Dojox (or “Dojo Toolkit”) is a collection of optional, extended, and experimental modules for the Dojo Toolkit that provide additional UI widgets, utilities, and advanced features beyond the core Dojo libraries.

‍

A low-severity Prototype Pollution vulnerability (CVE-2020-5259) has been identified in Dojox, which allows a malicious actor to modify an object's prototype, potentially leading to unexpected behavior or security issues.

‍

Per OWASP: Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's JavaScript objects and properties, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

‍

Details

Module Info

• Product: Dojo
• Affected packages: dojox
• Affected versions:
  <1.11.10,
  >=1.12.0 <1.12.8,
  >=1.13.0 <1.13.7,
  >=1.14.0 <1.14.6,
  >=1.15.0 <1.15.3,
  >=1.16.0 <1.16.2
• GitHub repository: https://github.com/dojo/dojox
• Published packages: https://www.npmjs.com/package/dojox
• Package manager: npm
• Fixed in: NES for Dojo v1.7.5, OSS v1.11.10, OSS v1.12.8, OSS v1.13.7, OSS v1.14.6, OSS v1.15.3, OSS v1.16.2

‍

Vulnerability Info

This low-severity vulnerability is found in many versions of Dojox less than 1.16.2. See the affected versions above for specific details.

The vulnerability affects the Dojox jQuery wrapper. The jqMix method allowed attackers to inject properties into JavaScript language construct prototypes by manipulating the special _​_proto_​_ property during object mixing operations.

‍

The jqMix function in jq.js recursively merges properties from a source object into a target object without validating property names. An attacker could exploit this by:

• Passing an object with a _​_proto_​_ property to functions using jqMix
• Polluting the prototype of base JavaScript objects (Object, Array, etc.)
• Injecting malicious properties accessible across the entire application
• Potentially modifying application behavior or bypassing security checks via injected properties

‍

The vulnerability affects the object merging logic used by $.extend and related jQuery-style API methods in Dojox.

‍

Mitigation

Dojox version 1.7.x is End-of-Life and will not receive any updates to address this issue. For more information see the Dojo website announcement.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a fixed version of Dojox and Dojo.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.