CVE-2021-23450

Overview

Dojo is a comprehensive JavaScript framework that provides modular tools for DOM manipulation, event handling, AJAX, internationalization, and object-oriented programming utilities for building web applications.

‍

A high-severity Prototype Pollution vulnerability (CVE-2021-23450) has been identified in Dojo, which allows a malicious actor to modify an object's prototype, potentially leading to unexpected behavior or security issues.

‍

Per OWASP: Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's JavaScript objects and properties, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

‍

Details

Module Info

• Product: Dojo
• Affected packages: dojo
• Affected versions:
  <1.11.13,
  >=1.12.0 <1.12.11,
  >=1.13.0 <1.13.10,
  >=1.14.0 <1.14.9,
  >=1.15.0 <1.15.6,
  >=1.16.0 <1.16.5
• GitHub repository: https://github.com/dojo/dojo
• Published packages: https://www.npmjs.com/package/dojo
• Package manager: npm
• Fixed in: NES for Dojo v1.7.5, OSS v1.11.13, OSS v1.12.11, OSS v1.13.10, OSS v1.14.9, OSS v1.15.6, OSS v1.16.5

‍

Vulnerability Info

This high-severity vulnerability is found in many versions of Dojo less than 1.16.5. See the affected versions above for specific details.

‍

The vulnerability exists in the dojo.setObject and dojo.getObject functions. When user-controlled property paths containing _​_proto_​_ or constructor are processed, attackers can pollute Object.prototype, leading to application-wide property injection that affects all JavaScript objects.

‍

- The getProp helper function in dojo/_base/lang.js traverses dot-separated property paths without validating property names, allowing access to special properties _​_proto_​_ and constructor.

‍

- Attackers can inject malicious properties into Object.prototype by calling dojo.setObject("_​_proto_​_.injected", "value") or  dojo.setObject("constructor.prototype.injected", "value"). These polluted properties then appear on all objects in the application, enabling privilege escalation, authentication bypass, or denial of service attacks depending on how the application uses object properties.

‍

Mitigation

Dojo version 1.7.x is End-of-Life and will not receive any updates to address this issue. For more information see the Dojo website announcement.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a fixed version of Dojo.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.