CVE-2019-10795: Prototype Pollution in undefsafe

Background

The package under scrutiny is undefsafe, an npm package. It is designed to safely access deeply nested properties of an object without throwing any errors. It is commonly used in JavaScript applications to prevent crashes caused by accessing undefined properties. However, versions prior to 2.0.3 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to manipulate or add properties to the Object.prototype using a __proto__ payload.

Vulnerability Detail

The Prototype Pollution vulnerability in undefsafe arises from the 'a' function's susceptibility to a __proto__ payload. By exploiting this vulnerability, an attacker can modify or add properties to the Object.prototype, potentially leading to unexpected behavior or security issues in the application. The impact of this vulnerability can range from data integrity issues to remote code execution.

npm install undefsafe@2.0.3

Workaround

If upgrading to the fixed version is not immediately feasible, a temporary workaround is to avoid using the vulnerable 'a' function or to implement input validation and sanitization to prevent malicious payloads from reaching the vulnerable function. Here is an example of input validation for the 'a' function:

function safeAccess(obj, path) {
  if (typeof obj !== 'object' || obj === null) {
    return undefined;
  }

  const keys = path.split('.');
  let result = obj;

  for (const key of keys) {
    if (!Object.prototype.hasOwnProperty.call(result, key)) {
      return undefined;
    }

    result = result[key];
  }

  return result;
}

Conclusion

In conclusion, the undefsafe package prior to version 2.0.3 is vulnerable to Prototype Pollution. This vulnerability allows an attacker to manipulate or add properties to the Object.prototype, potentially leading to unexpected behavior or security issues. It is crucial to upgrade to the fixed version or implement the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for undefsafe →

FAQ