Executive brief
assign-deep is a JavaScript utility library used to merge objects in Node.js and browser applications. A flaw in the assign function allows attackers to pollute the Object prototype, potentially modifying properties across all objects in an application and causing unexpected behavior or data corruption.
Technical details
assign-deep versions prior to 0.4.8 and 1.0.1 are vulnerable to prototype pollution via the assign function. The vulnerable function fails to properly validate object property keys before merging them, allowing attackers to inject the __proto__ property and other reserved keys to modify the Object prototype. An attacker can exploit this by passing a malicious object to the assign function, which is typically reachable over the network when used in server-side applications or exposed through APIs. This enables modification of shared prototype properties affecting all objects in the application. The fix, implemented in commits 8e3cc4a and 90bf1c5, introduces validation to reject invalid keys like __proto__ and constructor.
Affected products
- jonschlinkert assign-deep prior to 0.4.8 and 1.0.1
Timeline
- 2019-08-21: disclosed
- 2019-08-21: patched: Versions 0.4.8 and 1.0.1 released