Prototype Pollution in node-deep-extend
Summary
CVE-2018-3750: The utilities function in all versions. Affects node-deep-extend across 2 version ranges.
< 0.4.1-2
< adb9c495d1dccbff3e87cdae157dc856f3a05c65
Fixed in 0.4.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-deep-extend is a node module that provides utilities for extending JavaScript objects. It allows users to merge objects deeply, copying properties from one or more source objects to a target object. This package is commonly used in Node.js applications to simplify object manipulation and merging.
Vulnerability Detail
The utilities function in all versions <= 0.5.0 of the deep-extend node module is vulnerable to Prototype Pollution. When an attacker can control part of the structure passed to this function, they can trick it into modifying the prototype of the Object. This enables the attacker to add or modify existing properties that will exist on all objects. This vulnerability can lead to various security issues, such as arbitrary code execution, information disclosure, or denial of service.
How To Fix
Minimum fixed version
0.4.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-deep-extendTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the node-deep-extend package to mitigate the risk.
Conclusion
The Prototype Pollution vulnerability in the node-deep-extend package can have severe consequences, including arbitrary code execution and information disclosure. It is crucial to upgrade to the fixed version (0.4.1-2 or later) to mitigate the risk. Additionally, using tools like Vulert can help identify and address vulnerabilities in your application's dependencies.
See every vulnerability recorded for node-deep-extend →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. By manipulating the prototype, the attacker can add or modify properties that will affect all instances of that object.
The consequences of this vulnerability can vary depending on the attacker's intentions. They may be able to execute arbitrary code, access sensitive information, or disrupt the normal functioning of the application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will analyze your dependencies for known vulnerabilities.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for node-deep-extend.
