CVE-2020-7723: Prototype Pollution in promisehelpers
Summary
CVE-2020-7723: Prototype Pollution in promisehelpers. Affects promisehelpers versions < 0.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'promisehelpers' is an npm package that provides helper functions for working with promises. It is used to simplify asynchronous programming in JavaScript applications. The package is vulnerable to Prototype Pollution, a vulnerability that allows an attacker to modify the prototype of an object and potentially manipulate its behavior.
Vulnerability Detail
The vulnerability in 'promisehelpers' arises from the 'insert' function. This function does not properly sanitize user input, allowing an attacker to inject malicious properties into the prototype of an object. This can lead to various security issues, such as remote code execution, data tampering, or denial of service attacks. The vulnerability affects all versions of 'promisehelpers' up to and including version 0.0.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the 'insert' function in 'promisehelpers' or implement input validation and sanitization before using the function. Here is an example of how to sanitize the input:
function sanitizeInput(input) {
if (typeof input === 'object' && input !== null) {
for (const key in input) {
if (Object.prototype.hasOwnProperty.call(input, key)) {
if (key !== '__proto__') {
sanitizedInput[key] = input[key];
}
}
}
}
}
Conclusion
The 'promisehelpers' package is vulnerable to Prototype Pollution via the 'insert' function. To mitigate the vulnerability, users should update to version 0.0.6 or higher. It is also recommended to implement input validation and sanitization when using the affected function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for promisehelpers →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object. By injecting malicious properties into the prototype, the attacker can manipulate the behavior of the object and potentially exploit security weaknesses.
The consequences of this vulnerability can vary depending on the context in which the affected package is used. Possible consequences include remote code execution, data tampering, denial of service attacks, and privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the maintainers of 'promisehelpers' have released a fix in version 0.0.6. It is recommended to upgrade to this version or higher to mitigate the vulnerability.
As a workaround, you can avoid using the 'insert' function in 'promisehelpers' or implement input validation and sanitization before using the function. Refer to the 'workaround' section for an example of input sanitization.
