PrimeFaces PrimeReact Prototype Pollution Vulnerability in ObjectUtils.mutateFieldData

A prototype pollution vulnerability has been identified in PrimeFaces PrimeReact versions through 10.9.8. The issue arises in the ObjectUtils.mutateFieldData function within the component API, where the 'field' argument can be manipulated to improperly modify object prototype attributes. This vulnerability can be exploited remotely and affects unsupported products.

Impact

Exploitation of this vulnerability allows for prototype pollution of Object.prototype. This can disrupt application logic by interfering with authorization, configuration, feature flags, or control flow mechanisms that rely on inherited properties.

Reproduction

To reproduce this vulnerability, pass a field name containing prototype-related segments, such as '__proto__.polluted', into the ObjectUtils.mutateFieldData function. The function will traverse the object path and assign the specified value to Object.prototype. After this operation, any newly created objects will inherit the polluted property, demonstrating the successful exploitation of the vulnerability.

Remediation

PrimeReact has been archived and is no longer actively maintained. Users should consider migrating to PrimeUI, where active development continues.