CVE-2020-28477: immer prototype pollution in applyPatches

CVE-2020-28477 · Severity: low · CVSS 3.1 · Published 2021-01-20

immer is a widely-used JavaScript library for immutable state management in web applications. A prototype pollution vulnerability allows attackers to inject properties into JavaScript's Object prototype, potentially affecting all objects in the application and leading to denial of service, property manipulation, or privilege escalation depending on how the affected application uses the prototype chain.

Technologies: immer (npm). Vendors: npm.

Quick answers

Is CVE-2020-28477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-28477 being exploited in the wild.
How severe is CVE-2020-28477?
Low severity, with a CVSS score of 3.1, published 20 January 2021.
Which products and versions are affected?
immer (npm) SEMVER:introduced=7.0.0,fixed=8.0.1.
Is there a fix for CVE-2020-28477?
Yes. immer (npm): upgrade to 8.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-28477 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-28477?
Check whether you run immer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • immer (npm): upgrade to 8.0.1 or later
    npm install immer@8.0.1

Technical details

The vulnerability is a prototype pollution flaw (CWE-471) in the applyPatches function of immer, introduced in version 7.0.0. The root cause is insufficient validation of the patch operation path, allowing an attacker to specify paths like ["__proto__", "polluted"] which modify the Object prototype. The attack requires the application to call applyPatches with untrusted patch data; no authentication or user interaction is needed if patches come from an untrusted source (e.g., API response, user input). This can result in denial of service, object property injection, or logic bypasses. Version 8.0.1 and later contain a fix that sanitizes prototype-pollution-dangerous paths.

Affected products

  • immerjs immer 7.0.0 to before 8.0.1

Identifiers

  • CVE-2020-28477
  • GHSA-9qmh-276g-x5pj

Timeline

  • 2021-01-19: disclosed: Vulnerability reported to immerjs
  • 2021-01-20: patched: Fix released in version 8.0.1
  • 2021-01-20: advisory: GitHub Security Advisory GHSA-9qmh-276g-x5pj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.