CVE-2021-23329: Prototype Pollution in nested-object-assign
Summary
CVE-2021-23329: Prototype pollution in nested-object-assign. Affects nested-object-assign versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package nested-object-assign is an npm package that provides a function for assigning values to nested objects. It is commonly used in JavaScript applications to simplify object manipulation. However, versions before 1.0.4 of nested-object-assign are vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in nested-object-assign arises from the default function, which does not properly validate user input. An attacker can craft a malicious payload that manipulates the prototype of an object, leading to unexpected behavior and potential code execution. This can result in various security issues, such as privilege escalation, remote code execution, or data tampering.
How To Fix
Minimum fixed version
1.0.4
This is the first release that contains the fix.
npm install nested-object-assign@1.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of nested-object-assign to mitigate the risk of exploitation.
Conclusion
In conclusion, the nested-object-assign package before version 1.0.4 is vulnerable to Prototype Pollution. It is crucial for developers to update to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nested-object-assign →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential code execution.
The consequences of this vulnerability can include privilege escalation, remote code execution, or data tampering.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading to version 1.0.4 or later of nested-object-assign fixes this vulnerability. Make sure to update your package.json file and install the updated package.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-c497-v8pv-ch6x/GHSA-c497-v8pv-ch6x.json
