CVE-2021-23702: Prototype Pollution in object-extend
Summary
CVE-2021-23702: Prototype Pollution in object-extend. Affects object-extend versions < 0.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package object-extend is an npm package that provides a utility function for extending JavaScript objects. It allows developers to merge multiple objects into a single object, combining their properties. The package is widely used in JavaScript projects for object manipulation and extension. However, versions 0.0.0 through 0.5.0 of object-extend are vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
Vulnerability Detail
The vulnerability in object-extend arises from improper handling of user-supplied input during object extension. By manipulating the input, an attacker can inject malicious properties into the prototype of an object, potentially leading to code execution, privilege escalation, or other security breaches. This can occur when the package is used to merge objects without proper input validation or sanitization. The impact of this vulnerability can be severe, depending on how the extended objects are used in the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to manually validate and sanitize the input objects before using object-extend. This can involve checking the properties and values of the objects to ensure they are safe and free from any potentially malicious content. By implementing proper input validation and sanitization, the risk of Prototype Pollution can be mitigated.
Conclusion
The object-extend package versions 0.0.0 through 0.5.0 are vulnerable to Prototype Pollution, which can lead to severe security issues. It is crucial to upgrade to a fixed version of the package or implement proper input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for object-extend →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues. It occurs when user-supplied input is not properly validated or sanitized during object manipulation.
The consequences of Prototype Pollution can vary depending on the specific vulnerability and how the manipulated objects are used in the application. Possible consequences include code execution, privilege escalation, data tampering, and other security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to a version of object-extend that is not affected by the issue. The latest version of the package should have addressed the vulnerability.
If upgrading the package is not immediately feasible, a temporary workaround is to manually validate and sanitize the input objects before using object-extend. This can involve checking the properties and values of the objects to ensure they are safe and free from any potentially malicious content.
