PT-2021-11552 · Total.Js · Total.Js

Alessio Dellalibera · Published 2021-02-02 · Updated 2021-02-05 · CVE-2020-28495

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: total.js versions prior to 3.4.7

Description: The issue is related to a prototype pollution vulnerability in the set function, which can be used to set a value into an object according to a path. However, the keys of the path being set are not properly sanitized. The impact depends on the application and can lead to Denial of service (DoS), Remote Code Execution, or Property Injection in some cases.

Recommendations: For total.js versions prior to 3.4.7, update to version 3.4.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the set function to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Resource Exhaustion

Weakness Enumeration

CWE-1321

CWE-400

Related Identifiers

CVE-2020-28495

GHSA-6CF8-QHQJ-VJQM

SNYK-JS-TOTALJS-1046671

Affected Products

Total.Js

References · 11

• 🔥 https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671 · Exploit
• https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff · Patch
• https://osv.dev/vulnerability/GHSA-6cf8-qhqj-vjqm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28495 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28495 · Vendor Advisory
• https://github.com/totaljs/framework/blob/master/utils.js%23L6617 · Note
• https://github.com/totaljs/framework/blob/master/utils.js%23L6606 · Note
• https://npmjs.com/package/total.js · Note
• https://t.me/cibsecurity/22939 · Telegram Post
• https://t.me/cvenotify/9237 · Telegram Post
• https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set · Note