Horizon Alert
Summary of the vulnerability and why it matters
A prototype pollution vulnerability exists in Velocity.js, a JavaScript template engine. This flaw can allow attackers to alter the application's core JavaScript objects if they can control the templates being processed, potentially leading to service disruptions or unauthorized code execution. The main concern is confirming relevance and exposure.
- JavaScript templates can be poisoned.
- Attackers could disrupt services or run code.
- Confirm if Velocity.js is used.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by submitting specially crafted input to an application that uses a vulnerable version of Velocity.js to process templates. Because the vulnerability lies within the `#set` directive, an attacker could manipulate it to alter the `Object.prototype`, which could then lead to a denial of service or even remote code execution.
- Requires no authentication or privileges.
- Triggered by processing attacker-controlled templates.
- Risk of denial of service or code execution.
Live Threat
Current exploitation, exposure, and threat context
When an application uses Velocity.js to process attacker-controlled Velocity templates, especially through #set directives, it could allow for modifications to Object.prototype. This may lead to a Denial of Service or, depending on the server's configuration, Remote Code Execution.
- JavaScript object prototypes could be altered.
- Processing user-controlled Velocity templates.
- Service disruption or code execution.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and platform teams are likely responsible for managing Velocity.js instances. The first step is to identify all deployments of Velocity.js within your environment, confirm if they process untrusted input or are exposed externally, and then ascertain the business criticality and responsible owner for each instance to prioritize remediation efforts.
- Identify Velocity.js deployments.
- Verify external reachability and criticality.
- Plan remediation with application owners.
