critical9.8

CVE-2021-25944

deep-defaults vulnerable to prototype pollution

Impact

### Overview Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. ### Details The NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution. ### PoC The `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object's own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as "Yes! Its Polluted" as it had been polluted. ```js var deepDefaults = require("deep-defaults") var malicious_payload = '{"__proto__":{"polluted":"Yes! Its Polluted"}}'; var obj ={}; console.log("Before : " + {}.polluted); deepDefaults(obj, JSON.parse(malicious_payload)); console.log("After : " + {}.polluted); ```

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`deep-defaults`	>= 1.0.0, <= 1.0.5	none recorded

Affected products

Vendor	Product	Affected versions
Deep-Defaults Project	Deep-Defaults	from 1.0.0 through 1.0.5

Weakness classification

CWE-1321

Impact

Affected packages

Affected products

Weakness classification

References