Executive brief
assign-deep is a JavaScript library used for deep merging of objects in web applications. A flaw in versions before 0.4.7 allows attackers to pollute the JavaScript prototype chain via specially crafted merge operations, potentially enabling arbitrary code injection or privilege escalation in affected applications.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-471) in the assign-deep library's merge function. The vulnerable code failed to filter the __proto__ key when iterating over object properties during deep assignment, allowing attackers to modify the Object prototype and inject malicious properties into all objects in the application. The vulnerability is reachable if an attacker can control data passed to the merge/assign function, typically via network input or untrusted data sources. The fix (version 0.4.7) explicitly excludes the __proto__ key from merging operations.
Affected products
- npm assign-deep before 0.4.7
Timeline
- 2018-06-07: disclosed
- 2018-07-26: advisory
- 2018: patched: Version 0.4.7 released with fix