Description
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| stalniy | @casl/ability | 6.7.5 – < 7.0.2 | 7.0.2 |
References
- https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324 patch
- https://github.com/stalniy/casl/pull/1305 patch issue-tracking
- https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29 technical-description
- https://github.com/stalniy/casl product
- VulnCheck Advisory: @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath third-party-advisory