CVE-2021-25944 – deep-defaults

Package

Manager: npm
Name: deep-defaults
Vulnerable Version: >=1.0.0 <=1.0.5

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.0254 pctl0.84905

Details

deep-defaults vulnerable to prototype pollution ### Overview Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. ### Details The NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution. ### PoC The `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object's own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as "Yes! Its Polluted" as it had been polluted. ```js var deepDefaults = require("deep-defaults") var malicious_payload = '{"__proto__":{"polluted":"Yes! Its Polluted"}}'; var obj ={}; console.log("Before : " + {}.polluted); deepDefaults(obj, JSON.parse(malicious_payload)); console.log("After : " + {}.polluted); ```

Metadata

Created: 2022-05-24T19:03:10Z
Modified: 2024-04-22T23:22:36Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h6xg-rg33-9mf4/GHSA-h6xg-rg33-9mf4.json
CWE IDs: ["CWE-1321"]
Alternative ID: GHSA-h6xg-rg33-9mf4
Finding: F390
Auto approve: 1