CVE-2018-3751: Prototype Pollution in merge-recursive

Background

The merge-recursive package is an npm package used for merging JavaScript objects recursively. It provides a function called merge that takes two objects as input and merges them together. This package is vulnerable to Prototype Pollution, a type of vulnerability where an attacker can modify the prototype of an object by injecting malicious input. This vulnerability affects all versions of merge-recursive.

Vulnerability Detail

Prototype Pollution allows an attacker to modify the prototype of an object via the __proto__ property. In the case of merge-recursive, when malicious user input is merged with another object, it can lead to the addition or modification of existing properties. This can have severe consequences, as it allows an attacker to manipulate the behavior of the affected code and potentially execute arbitrary code. An example proof of concept code is provided in the vulnerability details.

Workaround

As there is no fix available, a workaround for this vulnerability is to manually sanitize and validate the input before merging it with other objects. This can involve checking the properties and values of the input object to ensure they are safe and do not contain any malicious code. Here is an example of how to sanitize the input object before merging:

var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);

// Sanitize the input object
var sanitized_payload = JSON.parse(malicious_payload);
if (typeof sanitized_payload === 'object' && sanitized_payload !== null) {
  delete sanitized_payload.__proto__;
}

merge({}, sanitized_payload);
console.log("After : " + a.oops);

This code snippet demonstrates how to remove the __proto__ property from the input object before merging it, effectively mitigating the Prototype Pollution vulnerability.

Conclusion

The merge-recursive package is vulnerable to Prototype Pollution, allowing an attacker to modify the prototype of an object via the __proto__ property. This can lead to the addition or modification of existing properties, potentially resulting in code execution or unexpected behavior. Currently, there is no fix available for this vulnerability. It is recommended to avoid using the merge-recursive package until a fix is provided. Manually sanitizing and validating the input before merging can help mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for merge-recursive →

FAQ