CVE-2018-3721: Prototype Pollution in lodash

Background

The lodash package is a popular utility library for JavaScript that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions of lodash before 4.17.5 are vulnerable to a security issue known as prototype pollution.

Vulnerability Detail

Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to the addition or modification of properties that will exist on all objects. In the case of lodash, the vulnerable functions 'defaultsDeep', 'merge', and 'mergeWith' can be exploited by a malicious user to modify the prototype of the Object via the __proto__ property. This can have serious consequences, as it allows the attacker to manipulate the behavior of the affected application and potentially execute arbitrary code.

npm install lodash@4.18.1

npm install lodash@4.17.5

Workaround

If you are unable to immediately update to the fixed version of lodash, you can implement a workaround by manually checking and sanitizing any user-supplied data before using the vulnerable functions. This involves validating and filtering the input to ensure it does not contain any malicious or unexpected values. Here's an example of how you can sanitize the input using a custom function:

function sanitizeInput(data) {
  if (typeof data === 'object' && !Array.isArray(data)) {
    // Perform deep sanitization of the object
    // Remove any potentially harmful properties
    // Return the sanitized object
  }
  return data;
}

Conclusion

Prototype pollution in lodash (CVE-2018-3721) is a serious vulnerability that allows an attacker to modify the prototype of an object, leading to potential code execution and manipulation of the affected application. It is crucial to update the lodash package to version 4.17.5 or later to mitigate this risk. If immediate update is not possible, implementing input sanitization can serve as a temporary workaround. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for lodash →

FAQ