Executive Summary

This vulnerability exists in the js-cookie JavaScript API prior to version 3.0.7. The issue arises because the internal assign() helper copies properties using a for...in loop combined with plain assignment. When the source object is created by JSON.parse, it includes an own enumerable "__proto__" property. This causes the for...in loop to enumerate "__proto__", triggering the Object.prototype.__proto__ setter on the target object. As a result, the target object's prototype is hijacked on a per-instance basis, meaning the merged attributes object inherits attacker-controlled keys without modifying Object.prototype itself.

Because the set() function later enumerates this merged object, every key placed by the attacker on the polluted prototype is included in the resulting Set-Cookie string as an attribute pair. This allows an attacker to set cookie attributes such as domain=, secure=, samesite=, expires=, and path= on cookies that the developer intended to be locked down.

This vulnerability has been fixed in version 3.0.7 of js-cookie.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to manipulate cookie attributes that developers believed were secure and immutable. By hijacking the prototype of the attributes object, an attacker can inject arbitrary cookie attributes such as domain, secure, samesite, expires, and path.

This manipulation can lead to security issues such as unauthorized cookie sharing across domains, bypassing secure cookie flags, or altering cookie expiration, potentially enabling session hijacking, cross-site request forgery (CSRF), or other attacks that rely on cookie integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the js-cookie library to version 3.0.7 or later, where the issue has been patched.

Useful 0 Not Useful 0