CVE-2018-16487: Prototype Pollution in lodash

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

lodash is a popular JavaScript utility library that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions of lodash before 4.17.5 are vulnerable to prototype pollution.

Vulnerability Detail

Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues. In the case of lodash, the vulnerable functions 'defaultsDeep', 'merge', and 'mergeWith' can be exploited by a malicious user to modify the prototype of the Object constructor. By passing a payload like {constructor: {prototype: {...}}}, the attacker can add or modify properties that will exist on all objects, potentially leading to code execution or privilege escalation.

npm install lodash@4.18.1

npm install lodash@4.17.11

Workaround

If updating lodash is not immediately feasible, a possible workaround is to sanitize and validate any user input or data before using the vulnerable functions. By carefully validating and sanitizing the input, the risk of prototype pollution can be mitigated. Here's an example of how to sanitize user input in Node.js:

const _ = require('lodash');

function sanitizeInput(input) {
  if (typeof input === 'object' && !Array.isArray(input)) {
    // Sanitize the input object
    return _.pickBy(input, (value, key) => typeof value === 'string');
  }

  // Return the input as is
  return input;
}

const userPayload = { constructor: { prototype: { isAdmin: true } } };
const sanitizedPayload = sanitizeInput(userPayload);

// Use the sanitized payload with the vulnerable lodash function
_.merge({}, sanitizedPayload);

Conclusion

Prototype pollution in lodash versions prior to 4.17.5 can lead to serious security issues. It is crucial to update to version 4.17.11 or later to mitigate the vulnerability. If immediate update is not possible, carefully sanitize and validate user input before using the vulnerable functions. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for lodash →

FAQ