CVE-2022-25354: Prototype Pollution in set-in
Summary
CVE-2022-25354: Prototype Pollution in set-in. Affects set-in versions < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The set-in package is an npm package that provides a method called setIn for merging object prototypes. It is commonly used in JavaScript applications to manipulate and modify objects. However, versions before 2.0.3 of set-in are vulnerable to a Prototype Pollution attack. This vulnerability allows an attacker to modify the prototype of an object, leading to potential security issues and unexpected behavior in the application.
Vulnerability Detail
The vulnerability in set-in arises from an incomplete fix of a previous vulnerability, CVE-2020-28273. The setIn method does not properly sanitize user input, allowing an attacker to inject malicious properties into the object's prototype chain. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.0.3
This is the first release that contains the fix.
npm install set-in@2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to implement input validation and sanitization before using the setIn method. This can help prevent malicious input from polluting the object's prototype chain. Here's an example of how to sanitize the input using a simple helper function:
function sanitizeInput(input) {
if (typeof input !== 'object' || input === null) {
return {};
}
return input;
}
const sanitizedInput = sanitizeInput(userInput);
setIn(sanitizedInput, 'property', 'value');
Conclusion
The set-in package versions before 2.0.3 are vulnerable to Prototype Pollution, which can lead to severe security issues. It is crucial to upgrade to version 2.0.3 or later to mitigate this vulnerability. If upgrading is not possible immediately, implementing input validation and sanitization can provide temporary protection. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for set-in →
FAQ
Prototype Pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. This can lead to unexpected behavior and security issues.
The set-in package becomes vulnerable to Prototype Pollution due to an incomplete fix of a previous vulnerability. The setIn method does not properly sanitize user input, allowing an attacker to inject malicious properties into the object's prototype chain.
The potential consequences of this vulnerability include remote code execution, information disclosure, and denial of service. An attacker can manipulate the object's prototype chain to execute arbitrary code or access sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities, including CVE-2022-25354.
If upgrading to the fixed version is not immediately feasible, you can implement input validation and sanitization before using the setIn method. This can help prevent malicious input from polluting the object's prototype chain.
Related vulnerabilities
Recent vulnerabilities recorded for set-in.
