Executive brief
The extend library is a JavaScript utility used to merge objects together, commonly used in Node.js applications. A prototype pollution vulnerability allows attackers to modify the prototype of Object, adding or modifying properties that will exist on all objects in the application. This could lead to unexpected behavior, data corruption, or serve as a foothold for further attacks.
Technical details
The vulnerability is a prototype pollution flaw in the extend() function, classified as CWE-400. Versions prior to 3.0.2 (3.x branch) and 2.0.2 (2.x branch) fail to properly sanitize keys during object merging, allowing attackers to inject properties into Object.prototype. The attack requires the attacker to control the input object being merged via extend(). Once exploited, any subsequently created object inherits the polluted properties, potentially affecting application logic and security controls. Patches are available in extend 3.0.2 and 2.0.2.
Affected products
- npm extend 1.1.3 to 2.0.1 and 3.0.0 to 3.0.1
Timeline
- 2019-02-07: disclosed: Advisory published
- 2018: patched: CVE-2018-16492 assigned