Executive brief
deephas is a JavaScript utility library used for checking object properties. A prototype pollution flaw in versions 1.0.0–1.0.5 allows attackers to manipulate object prototypes over the network, potentially causing service outages or enabling code execution on affected systems. This can compromise application functionality and data integrity.
Technical details
deephas contains a prototype pollution vulnerability (CWE-1321, CWE-915) in versions 1.0.0 through 1.0.5. An attacker can exploit this flaw by crafting malicious input that modifies object prototype properties, bypassing the library's property checks. The attack is network-reachable, requires no authentication or user interaction, and can lead to both denial of service through resource exhaustion and remote code execution via gadget chains. The vulnerability was patched in commit 2fe0117, addressing the unsafe property access patterns in the affected code.
Affected products
- sharpred deephas 1.0.0 through 1.0.5
Timeline
- 2020-11-12: disclosed: Vulnerability published on NVD
- 2020-10-27: patched: Fix committed by maintainer
- 2021-09-24: advisory: GHSA advisory published