Executive brief
lodash is a widely-used JavaScript utility library for manipulating objects and arrays. A flaw in the defaultsDeep function allows attackers to inject properties into the JavaScript Object prototype, potentially corrupting or hijacking the behavior of all objects application-wide. This can lead to authentication bypasses, data tampering, or application crashes depending on how the affected code uses objects.
Technical details
The vulnerability is a prototype pollution flaw in lodash's defaultsDeep function (CWE-1321, CWE-20). Versions before 4.17.12 fail to properly validate input when merging nested objects, allowing a malicious user to inject properties via a crafted object with a {constructor: {prototype: {...}}} structure. The attack requires the application to call defaultsDeep with untrusted input (no authentication required, network-reachable if the function processes user-controlled data). An attacker can modify or add properties to Object.prototype, affecting all JavaScript objects in the application. The fix is available in lodash 4.17.12 (npm), 4.17.13 (lodash-amd), 4.17.14 (lodash-es), and 4.6.1 (lodash.defaultsdeep).
Affected products
- lodash lodash before 4.17.12
- lodash lodash-es before 4.17.14
- lodash lodash-amd before 4.17.13
- lodash lodash.defaultsdeep before 4.6.1
- lodash lodash-rails before 4.17.12
Timeline
- 2019-07-10: disclosed: Vulnerability published on 2019-07-10
- 2019-06-24: patched: Fix merged in lodash PR #4336 for 4.17.12-pre branch