CVE-2021-23403: Prototype Pollution in ts-nodash
Summary
CVE-2021-23403: Prototype Pollution in ts-nodash. Affects ts-nodash versions < 1.2.7. Fixed in 1.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ts-nodash is an npm package that provides utility functions for working with TypeScript. It is widely used in TypeScript projects to enhance productivity and code quality. However, versions prior to 1.2.7 are vulnerable to Prototype Pollution through the Merge() function. This vulnerability arises due to a lack of input validation, allowing an attacker to modify the prototype of objects and potentially execute arbitrary code.
Vulnerability Detail
The Prototype Pollution vulnerability in ts-nodash can have severe consequences. By manipulating the Merge() function, an attacker can modify the behavior of objects in unexpected ways, leading to data corruption, unauthorized access, or remote code execution. This can result in the compromise of sensitive information, unauthorized actions, or the complete takeover of the affected system. It is crucial to address this vulnerability promptly to prevent potential exploitation.
How To Fix
Minimum fixed version
1.2.7
This is the first release that contains the fix.
npm install ts-nodash@1.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the input before using the Merge() function. Ensure that the input is trusted and does not contain any malicious data. Here is an example of how to perform input validation in TypeScript:
function mergeSafely(target: object, source: object): object {
if (typeof target !== 'object' || typeof source !== 'object') {
throw new Error('Invalid input');
}
// Perform the merge safely
// ...
return target;
}
Conclusion
The Prototype Pollution vulnerability in ts-nodash (CVE-2021-23403) poses a significant risk to applications using affected versions. It is crucial to update to version 1.2.7 or later to mitigate this vulnerability. By upgrading the package and implementing proper input validation, you can protect your application from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ts-nodash →
FAQ
ts-nodash is an npm package that provides utility functions for working with TypeScript. It helps developers write cleaner and more efficient code by offering various helper functions and extensions.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of objects. By injecting malicious properties or methods into the prototype chain, the attacker can manipulate the behavior of objects and potentially execute arbitrary code.
The Merge() function in ts-nodash is vulnerable to Prototype Pollution because it does not properly validate the input. An attacker can exploit this by injecting malicious properties or methods into the objects being merged, leading to unexpected behavior and potential code execution.
The consequences of this vulnerability can be severe. An attacker can manipulate the behavior of objects, leading to data corruption, unauthorized access, or remote code execution. This can result in the compromise of sensitive information, unauthorized actions, or the complete takeover of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
