CVE-2019-10744: lodash prototype pollution in defaultsDeep

CVE-2019-10744 · Severity: low · CVSS 3.1 · Published 2019-07-10

lodash is a widely-used JavaScript utility library for manipulating objects and arrays. A flaw in the defaultsDeep function allows attackers to inject properties into the JavaScript Object prototype, potentially corrupting or hijacking the behavior of all objects application-wide. This can lead to authentication bypasses, data tampering, or application crashes depending on how the affected code uses objects.

Technologies: Lodash-Amd, lodash (npm), lodash-es (npm), lodash.defaultsdeep (npm), lodash-rails (RubyGems). Vendors: Lodash, npm, RubyGems.

Quick answers

Is CVE-2019-10744 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-10744 being exploited in the wild.
How severe is CVE-2019-10744?
Low severity, with a CVSS score of 3.1, published 10 July 2019.
Which products and versions are affected?
Lodash-Amd before 4.17.13; lodash (npm) SEMVER:introduced=0,fixed=4.17.12; lodash-es (npm) SEMVER:introduced=0,fixed=4.17.14; lodash.defaultsdeep (npm) SEMVER:introduced=0,fixed=4.6.1; and 1 more.
Is there a fix for CVE-2019-10744?
Yes. lodash (npm): upgrade to 4.17.12 or later; lodash-es (npm): upgrade to 4.17.14 or later; lodash.defaultsdeep (npm): upgrade to 4.6.1 or later; lodash-rails (RubyGems): upgrade to 4.17.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-10744 attacked?
It is attacked over the network.
Am I affected by CVE-2019-10744?
Check whether you run Lodash-Amd, lodash (npm), lodash-es (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lodash (npm): upgrade to 4.17.12 or later
    npm install lodash@4.17.12
  • lodash-es (npm): upgrade to 4.17.14 or later
    npm install lodash-es@4.17.14
  • lodash.defaultsdeep (npm): upgrade to 4.6.1 or later
    npm install lodash.defaultsdeep@4.6.1
  • lodash-rails (RubyGems): upgrade to 4.17.12 or later
    bundle update lodash-rails

Technical details

The vulnerability is a prototype pollution flaw in lodash's defaultsDeep function (CWE-1321, CWE-20). Versions before 4.17.12 fail to properly validate input when merging nested objects, allowing a malicious user to inject properties via a crafted object with a {constructor: {prototype: {...}}} structure. The attack requires the application to call defaultsDeep with untrusted input (no authentication required, network-reachable if the function processes user-controlled data). An attacker can modify or add properties to Object.prototype, affecting all JavaScript objects in the application. The fix is available in lodash 4.17.12 (npm), 4.17.13 (lodash-amd), 4.17.14 (lodash-es), and 4.6.1 (lodash.defaultsdeep).

Affected products

  • lodash lodash before 4.17.12
  • lodash lodash-es before 4.17.14
  • lodash lodash-amd before 4.17.13
  • lodash lodash.defaultsdeep before 4.6.1
  • lodash lodash-rails before 4.17.12

Identifiers

  • CVE-2019-10744
  • GHSA-jf85-cpcp-j695

Timeline

  • 2019-07-10: disclosed: Vulnerability published on 2019-07-10
  • 2019-06-24: patched: Fix merged in lodash PR #4336 for 4.17.12-pre branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.