CVE-2020-8147: Prototype Pollution in utils-extend
Summary
CVE-2020-8147: Prototype Pollution. Affects utils-extend versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
utils-extend is an npm package that provides a utility function called 'extend' for extending JavaScript objects. It allows developers to merge multiple objects into a single object, combining their properties. This package is widely used in various JavaScript applications.
Vulnerability Detail
The utils-extend package is vulnerable to prototype pollution. The 'extend' function does not properly restrict the modification of an object's prototype. This allows an attacker to add or modify properties on the prototype, which will then be present on all objects that inherit from it. This can lead to various security issues, such as arbitrary code execution, information disclosure, or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually sanitize and validate any input that is used with the 'extend' function. By carefully checking the properties and values being merged, developers can mitigate the risk of prototype pollution. Here is an example of how to sanitize the input:
const extend = require('utils-extend');
function sanitizeAndExtend(target, ...sources) {
for (const source of sources) {
for (const key in source) {
if (Object.prototype.hasOwnProperty.call(source, key)) {
if (typeof source[key] === 'object' && source[key] !== null) {
if (typeof target[key] !== 'object' || target[key] === null) {
target[key] = {};
}
sanitizeAndExtend(target[key], source[key]);
} else {
target[key] = source[key];
}
}
}
}
}
const sanitizedObject = {};
sanitizeAndExtend(sanitizedObject, maliciousObject);
Conclusion
The utils-extend package is vulnerable to prototype pollution, which can have severe security implications. Currently, there is no fix available, and it is recommended to consider using an alternative package. Stay updated with official sources for any future patches or updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for utils-extend →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to add or modify properties that will affect all instances of that object. This can lead to various security issues.
The 'extend' function in the utils-extend package does not properly restrict modifications to an object's prototype. This allows an attacker to pollute the prototype and introduce malicious properties that will impact all objects that inherit from it.
The consequences of this vulnerability can vary depending on how the affected package is used. It can lead to arbitrary code execution, information disclosure, or denial of service attacks. Attackers can manipulate the behavior of the application by adding or modifying properties on all objects.
Currently, there is no fix available for the utils-extend package. It is recommended to use an alternative package that does not suffer from prototype pollution. Keep an eye on official sources for any updates or patches that may address this issue.
Developers can mitigate the risk of prototype pollution by carefully sanitizing and validating any input that is used with the vulnerable function. By ensuring that only safe and expected properties are merged, the impact of prototype pollution can be minimized.
Related vulnerabilities
Recent vulnerabilities recorded for utils-extend.
