Velocity.js Prototype Pollution Vulnerability in #set Directives Allowing Denial-of-Service or Remote Code Execution

A prototype pollution vulnerability exists in Velocity.js versions 2.1.5 and earlier. This vulnerability arises during the processing of #set directives in Velocity templates. When an application renders a template that an attacker controls, it can be exploited to modify Object.prototype. This modification could lead to a denial-of-service condition or remote code execution, depending on the server environment.

Impact

Exploitation of this vulnerability allows for prototype pollution, which can be used to bypass security controls, cause application crashes, or be combined with other vulnerabilities to execute code remotely.

Reproduction

The vulnerability can be reproduced by rendering a Velocity template that includes a #set directive. The directive can be crafted to assign a value to a property on Object.prototype, such as '__proto__', which would then be accessible on all objects.