CVE-2024-24294: 
JavaScript vulnerability analysis and mitigation

A Prototype Pollution vulnerability was discovered in Blackprint @blackprint/engine affecting versions from 0.8.12 to 0.9.1. The vulnerability allows an attacker to execute arbitrary code through the _utils.setDeepProperty function in engine.min.js (GitHub Gist, CVE Mitre).

The vulnerability stems from the setDeepProperty function which recursively assigns source properties to the destination without proper validation. This allows attackers to modify the prototype of Object using payloads structured like [["proto"], "..."], leading to prototype pollution. The vulnerability has been assigned a CVSS Score of 9.8 (CRITICAL) (GitHub Gist).

When successfully exploited, the vulnerability allows attackers to modify the prototype of Object, potentially leading to arbitrary code execution. This can affect all objects in the application, as demonstrated by proof of concept code showing the pollution of object prototypes (GitHub Gist).

A proof of concept exploit has been publicly documented that demonstrates how the vulnerability can be triggered using the _utils.setDeepProperty function. The exploit shows how an attacker can successfully pollute object prototypes by injecting malicious properties (GitHub Gist).

The vulnerability has been patched in version 0.9.2. Users are advised to upgrade to version 0.9.2 or later to mitigate this security issue (GitHub Gist).