CVE-2021-25928: Prototype Pollution in safe-obj
Summary
CVE-2021-25928: Prototype pollution in safe-obj. Affects safe-obj versions >= 1.0.0, <= 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
safe-obj is an npm package that provides a safe way to access and manipulate JavaScript objects. It is commonly used in web applications to prevent prototype pollution attacks. Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues. In versions 1.0.0 through 1.0.2 of safe-obj, a prototype pollution vulnerability has been identified.
Vulnerability Detail
The prototype pollution vulnerability in safe-obj versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution. By manipulating the prototype of an object, an attacker can modify its behavior and potentially execute arbitrary code. This can result in unauthorized access, data leakage, or complete system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the safe-obj package is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to validate and sanitize user input before using it with safe-obj. By ensuring that only trusted and properly validated data is passed to safe-obj, the risk of exploitation can be reduced. Here is an example of input validation and sanitization in JavaScript:
function sanitizeInput(input) {
// Perform input validation and sanitization
// ...
return sanitizedInput;
}
const safeObj = require('safe-obj');
const userInput = req.body.userInput;
const sanitizedInput = sanitizeInput(userInput);
const result = safeObj.get(sanitizedInput, 'some.property');
Conclusion
The prototype pollution vulnerability in safe-obj versions 1.0.0 through 1.0.2 poses a significant risk to applications using this package. It is crucial to update to safe-obj version 1.0.3 or higher to mitigate the vulnerability. If immediate updating is not possible, implementing input validation and sanitization can provide a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for safe-obj →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues. By manipulating the prototype, an attacker can modify the behavior of an object and potentially execute arbitrary code.
The safe-obj package provides a safe way to access and manipulate JavaScript objects by implementing strict checks and preventing prototype pollution attacks. However, versions 1.0.0 through 1.0.2 of safe-obj have a vulnerability that allows for prototype pollution.
The prototype pollution vulnerability in safe-obj can lead to a denial of service and remote code execution. An attacker could exploit this vulnerability to gain unauthorized access, leak sensitive data, or compromise the entire system.
Yes, the maintainers of safe-obj have released a patch in version 1.0.3 that addresses the prototype pollution vulnerability. It is recommended to update to safe-obj version 1.0.3 or higher to mitigate the risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file without requiring access to the code or installation.
