CVE-2020-28480: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-28480 affects the JointJS package versions before 3.3.0. This prototype pollution vulnerability was discovered and disclosed on January 19, 2021. The vulnerability exists in the util.setByPath function of JointJS, a JavaScript diagramming library used for creating static diagrams and interactive diagramming tools (Snyk JS).

The vulnerability stems from improper sanitization of the path parameter in the util.setByPath function. When accessing an object's key and setting its value, the path is not properly sanitized, which leads to prototype pollution. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST and 7.3 (HIGH) from Snyk (NVD, Snyk JS).

The vulnerability can lead to prototype pollution attacks, which can result in multiple types of impacts: denial of service through JavaScript exceptions, tampering with application source code, and potential remote code execution. The attacker can inject properties into existing JavaScript language construct prototypes, affecting all JavaScript objects through the prototype chain (Snyk JS).

The vulnerability is exploitable through a proof-of-concept that involves using the util.setByPath function with specially crafted path parameters. An attacker can exploit this by setting paths like 'proto/polluted' or 'constructor/prototype/polluted' to inject malicious values. The vulnerability requires no special privileges or user interaction to exploit (Snyk JS).

The vulnerability was fixed in JointJS version 3.3.0. Users should upgrade to this version or later to mitigate the risk. For those unable to upgrade immediately, recommended preventive measures include: freezing the prototype using Object.freeze(Object.prototype), implementing schema validation for JSON input, avoiding unsafe recursive merge functions, and using objects without prototypes or using Map instead of Object (Snyk JS).