Prototype Pollution in lodash.defaultsdeep
Summary
GHSA-46fh-8fc5-xcwx: Prototype Pollution in lodash.defaultsdeep. Affects lodash.defaultsdeep versions < 4.6.1. Fixed in 4.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'lodash.defaultsdeep' is an npm package that provides a utility function called 'defaultsDeep'. This function is used to merge the properties of multiple objects into a single object, with the values from the later objects overwriting the values from the earlier ones. It is commonly used in JavaScript applications to set default values for configuration objects or to merge user-provided options with default options.
However, versions of 'lodash.defaultsdeep' before 4.6.1 are vulnerable to Prototype Pollution. This vulnerability allows a malicious user to modify the prototype of the 'Object' via the 'proto' property, leading to the addition or modification of an existing property that will exist on all objects. This can result in unexpected behavior or security issues in applications that use 'lodash.defaultsdeep'.
Vulnerability Detail
The vulnerability in 'lodash.defaultsdeep' arises from the function's failure to properly sanitize user input. By manipulating the 'proto' property, an attacker can pollute the prototype of 'Object' and introduce or modify properties that will be present in all objects. This can lead to various security issues, such as privilege escalation, remote code execution, or data tampering.
The impact of this vulnerability depends on how the affected package is used within an application. If the package is used in a critical context where the modified prototype can be abused, the consequences can be severe. It is important to note that this vulnerability can only be exploited if untrusted user input is passed to the 'defaultsDeep' function.
How To Fix
Minimum fixed version
4.6.1
This is the first release that contains the fix.
npm install lodash.defaultsdeep@4.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating 'lodash.defaultsdeep' is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the input before passing it to the 'defaultsDeep' function. This can be done by validating and filtering the input to ensure that it does not contain any malicious or unexpected values. Here is an example of how this can be achieved in JavaScript:
const lodash = require('lodash.defaultsdeep');
function sanitizeInput(input) {
// Perform input validation and filtering here
// to prevent prototype pollution
return input;
}
const sanitizedInput = sanitizeInput(userInput);
const mergedObject = lodash.defaultsDeep({}, sanitizedInput);
Conclusion
In conclusion, the 'lodash.defaultsdeep' package versions prior to 4.6.1 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to modify the prototype of 'Object' via the 'proto' property, potentially leading to security issues or unexpected behavior. It is crucial to update the package to the latest version or implement a temporary workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lodash.defaultsdeep →
FAQ
'lodash.defaultsdeep' is an npm package that provides a utility function called 'defaultsDeep'. It is used to merge the properties of multiple objects into a single object, with the values from the later objects overwriting the values from the earlier ones.
Prototype Pollution is a vulnerability that occurs when a JavaScript application allows the modification of the prototype of an object. This can lead to unexpected behavior or security issues, as the modified prototype affects all instances of the object.
The vulnerability in 'lodash.defaultsdeep' allows a malicious user to modify the prototype of the 'Object' via the 'proto' property. This can result in the addition or modification of properties that will exist on all objects, leading to potential security issues.
The consequences of this vulnerability depend on how the affected package is used within an application. Possible consequences include privilege escalation, remote code execution, or data tampering if the modified prototype is abused in a critical context.
To fix this vulnerability, it is recommended to update 'lodash.defaultsdeep' to version 4.6.1 or later. This version includes a fix that properly sanitizes user input and prevents prototype pollution. Updating the package eliminates the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.defaultsdeep.
