Improper Prototype Pollution in CartoDB carto-api-client

Executive Summary

This is a prototype pollution vulnerability in the CartoDB carto-api-client library version 0.5.29. The issue occurs in the addFilter function of src/filters.ts where the column parameter is used as a dynamic property name without validation. When column is set to __proto__, it allows modifying Object.prototype by writing filter data directly to it. This bypasses normal checks and can cause unintended property inheritance across all objects in the application.

The vulnerability arises because filters[column] resolves to Object.prototype when column is __proto__, enabling direct assignment of properties to the prototype. This can disrupt application logic, cause unexpected behavior, or lead to denial of service by affecting property existence checks and default objects.

Useful 0 Not Useful 0

Detection Guidance

To detect this prototype pollution vulnerability in carto-api-client 0.5.29, inspect JavaScript/TypeScript applications using this library for improper handling of the addFilter function. Check if user-controlled input is passed as the column parameter without validation. Look for dynamic property assignments using Object.prototype or similar primitives.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact applications using untrusted or partially trusted filter options. It may cause unexpected behavior, logic bypasses, or denial of service by disrupting property checks and default objects. Attackers could manipulate application behavior through prototype pollution, potentially gaining unintended control over application logic or data processing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling prototype pollution attacks that may lead to unauthorized data access, modification, or denial of service. Such attacks could compromise data integrity or availability, which are key requirements under these regulations. However, the specific impact depends on how the vulnerable library is used in a system handling personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update to a patched version of carto-api-client if available. If not, implement input validation to reject prototype pollution primitives like __proto__, prototype, and constructor. Validate dynamic keys and ensure filters[column] checks own properties only. Use Object.create(null) for filter maps and add runtime validation for the type parameter.

Useful 0 Not Useful 0