CVE-2020-28282: Prototype pollution vulnerability in 'getobject'
Summary
CVE-2020-28282: Prototype pollution in getobject. Affects getobject versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- node-getobject · Debian:11
The same CVE-2020-28282 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'getobject' package is an npm package that provides a utility function for retrieving nested properties from JavaScript objects. It is commonly used in JavaScript applications to access and manipulate object properties. However, versions prior to 1.0.0 are vulnerable to a prototype pollution vulnerability.
Vulnerability Detail
The prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to control or manipulate its behavior. In this case, an attacker can exploit the vulnerability to modify the prototype of 'getobject' objects, potentially leading to arbitrary code execution or other malicious activities.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
npm install getobject@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the 'getobject' package to mitigate the risk.
Conclusion
The 'getobject' package version 0.1.0 is vulnerable to a prototype pollution vulnerability, which can result in a denial of service and potential remote code execution. It is crucial to update to version 1.0.0 or later to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getobject →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to control or manipulate its behavior. It can lead to various security issues, including remote code execution, denial of service, and data tampering.
The 'getobject' package is vulnerable to prototype pollution due to insufficient input validation and sanitization. This allows an attacker to inject malicious properties into the object's prototype chain, leading to unexpected behavior and potential security risks.
The prototype pollution vulnerability in 'getobject' can have severe consequences. It can allow an attacker to execute arbitrary code, modify data, or cause a denial of service. These actions can lead to unauthorized access, data breaches, and system compromise.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is essential to update to the fixed version of the 'getobject' package to prevent any potential exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file, without requiring access to the code or installation.
