# GHSA-m56h-5xx3-2jc2: Prototype pollution in jsii.configureCategories

> Prototype pollution in jsii library allows attackers to inject properties into Object prototype via untrusted input, potentially altering application logic.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Dec 2024

## What is GHSA-m56h-5xx3-2jc2?

GHSA-m56h-5xx3-2jc2 is a vulnerability in jsii, published on 18 Dec 2024. 

### Official description

## Summary

`jsii` is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library.
When loaded as a library into a larger application, prototype pollution may happen if untrusted user input is passed to the library. When used as a command line-tool, this pollution cannot occur.

## Impact

You may be impacted if you have written an application that loads jsii as a library, and passes untrusted user input into the `jsii.configureCategories()` function. In that case, a user can craft input in such a way that, following the invocation, a field named "category" with a user-controlled value is added to the JavaScript Object prototype. This will cause every object in the program (both new and existing) to have a field named "category", even if it shouldn't. 

**This will not affect jsii itself, but it might affect the application you have loaded jsii into.**

> The function `jsii.configureCategories()` is used to configure the severity (error, warning, etc.) of various jsii diagnostics.

**Impacted versions: <=5.7.2, <=5.6.3, <=5.5.14, <=5.4.45** 

**Example:**

```js
const jsii = require('jsii');

// prints 'undefined'
console.log(JSON.stringify({}.category))

// calling 'configureCategories' with user input
jsii.configureCategories(JSON.parse('{"__proto__": "user-input"}'))

// from this point onwards, every single object literal in the program
// will contain the 'category' key, with user controlled value
console.log(JSON.stringify({}.category)) // prints 'user-input'

// this can affect the execution of the main program in case it also makes 
// use of an object key called 'category'. for example, if the main programs 
// happens to have code like this:

const x = {} // some object in the main program (not necessarily empty)

if (x.category) {
  // this block will always be executed, effectively 
  // changing the behavior of the main program.
  console.log('Do something')
} else {
  console.log('Do something else')
}
```

For more information about javascript prototype pollution, see [1].

## Patches

A patch is included in versions [5.7.3](https://github.com/aws/jsii-compiler/releases/tag/v5.7.3), [5.6.4](https://github.com/aws/jsii-compiler/releases/tag/v5.6.4), [5.5.15](https://github.com/aws/jsii-compiler/releases/tag/v5.5.15), [5.4.46](https://github.com/aws/jsii-compiler/releases/tag/v5.4.46)

## Workarounds

Sanitize user input to configureCategories() by stripping the __proto__ property if detected.

## References

If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our issue reporting page [2] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

[1] https://learn.snyk.io/lesson/prototype-pollution/

[2] [https://aws.amazon.com/security/issue-reporting](https://aws.amazon.com/security/vulnerability-reporting)

## Credits

We would like to thank _Tariq Hawis_ for collaborating on this issue through the coordinated vulnerability disclosure process.

## Which versions are affected by GHSA-m56h-5xx3-2jc2?

8 open source packages ship an affected version, including jsii.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `jsii` | npm | From 5.4.0 | 5.4.46 |
| `jsii` | npm | From 5.4.0 | 5.4.46 |
| `jsii` | npm | From 5.5.0 | 5.5.15 |
| `jsii` | npm | From 5.5.0 | 5.5.15 |
| `jsii` | npm | From 5.6.0 | 5.6.4 |
| `jsii` | npm | From 5.6.0 | 5.6.4 |
| `jsii` | npm | From 5.7.0 | 5.7.3 |
| `jsii` | npm | From 5.7.0 | 5.7.3 |

## How do I fix GHSA-m56h-5xx3-2jc2?

Upgrade jsii to a fixed version for your release line: 5.4.46, 5.5.15, 5.6.4 or 5.7.3.

## Is GHSA-m56h-5xx3-2jc2 being exploited?

There is no known exploitation of GHSA-m56h-5xx3-2jc2 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-m56h-5xx3-2jc2 and fix it if it is affected.

What it is: GHSA-m56h-5xx3-2jc2 is a vulnerability in jsii, published on 18 Dec 2024. 
Exploitation: There is no known exploitation of GHSA-m56h-5xx3-2jc2 in the wild and no public exploit code.

Affected packages and fixed versions:
- jsii (npm): affected from 5.4.0; fixed in 5.4.46
- jsii (npm): affected from 5.4.0; fixed in 5.4.46
- jsii (npm): affected from 5.5.0; fixed in 5.5.15
- jsii (npm): affected from 5.5.0; fixed in 5.5.15
- jsii (npm): affected from 5.6.0; fixed in 5.6.4
- jsii (npm): affected from 5.6.0; fixed in 5.6.4
- jsii (npm): affected from 5.7.0; fixed in 5.7.3
- jsii (npm): affected from 5.7.0; fixed in 5.7.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-m56h-5xx3-2jc2/ (Markdown: https://insights.sbomify.com/GHSA-m56h-5xx3-2jc2/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-m56h-5xx3-2jc2

---
From sbomify Insights: https://insights.sbomify.com/GHSA-m56h-5xx3-2jc2/
Summaries are generated and may contain mistakes; the official description above is the record.