Executive brief
The merge-object npm library is a utility used by Node.js developers to recursively merge configuration objects and data structures. A prototype pollution vulnerability allows attackers who can control input data to inject or modify properties on the JavaScript Object prototype itself, affecting all objects in an application and potentially leading to application crashes, privilege escalation, or remote code execution.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-20) in the merge-object utilities function that fails to properly validate object keys during recursive merging. An attacker who can supply a crafted object with special keys like "__proto__" or "constructor.prototype" can modify the Object prototype. No authentication is required; the attack succeeds if the application passes attacker-controlled data directly to the merge-object function. Successful exploitation allows modification of all object properties in the runtime. The library version 1.0.0 and all earlier versions are affected.
Affected products
- npm merge-object <=1.0.0
Timeline
- 2018-09-18: disclosed