CVE-2020-7792: Prototype Pollution in mout
Summary
CVE-2020-7792: Prototype Pollution in mout. Affects mout versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mout package is an open-source utility library for JavaScript that provides various functions for manipulating objects, arrays, and other data structures. It is commonly used in Node.js and browser-based applications. The vulnerability in mout arises from the deepFillIn and deepMixIn functions, which are used to recursively fill missing properties and mix objects into the target object. Due to a lack of key validation, an attacker can exploit this vulnerability to perform Prototype Pollution attacks.
Vulnerability Detail
The vulnerability allows an attacker to modify the prototype of an object by injecting malicious properties. This can lead to various security issues, such as remote code execution, denial of service, or information disclosure. By manipulating the prototype chain, an attacker can modify the behavior of the affected application and potentially execute arbitrary code. The impact of this vulnerability is considered high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.2.3
This is the first release that contains the fix.
npm install mout@1.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the mout package is not immediately feasible, a temporary workaround is to manually validate the keys used for recursive object manipulation in the affected code. This can be done by explicitly checking the keys against a whitelist of allowed properties before performing any object mixing or property filling operations.
Conclusion
The Prototype Pollution vulnerability in the mout package can have severe security implications for applications using affected versions. It is crucial to update to version 1.2.3 or later to mitigate the risk. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mout →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
This vulnerability can be exploited to execute arbitrary code, perform denial of service attacks, or disclose sensitive information, depending on the specific context of the application.
Yes, all versions of the mout package are affected by this vulnerability. It is recommended to update to version 1.2.3 or later to mitigate the risk.
While specific exploits may not be publicly available, Prototype Pollution vulnerabilities are actively targeted by attackers. It is crucial to apply the recommended fix as soon as possible.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mout.
