CVE-2020-36604: hapi hoek prototype pollution in clone function

CVE-2020-36604 · Severity: low · CVSS 3.1 · Published 2022-09-25

hoek is a popular utility library used by Node.js applications for object manipulation and validation. A flaw in the clone() function allows attackers to inject properties into the prototype chain if they can pass a specially crafted object with a "__proto__" key to the function. This prototype pollution could enable unauthorized modification of application behavior or object properties across the entire system.

Vendors: Hapi.

Quick answers

Is CVE-2020-36604 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-36604 being exploited in the wild.
How severe is CVE-2020-36604?
Low severity, with a CVSS score of 3.1, published 25 September 2022.
Which products and versions are affected?
Hapi Hoek prior to 8.5.1; 9.x prior to 9.0.3.
Is there a fix for CVE-2020-36604?
A patch was published on 2022-09-25: Patch available in versions 8.5.1 and 9.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-36604 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-36604?
Check whether you run Hapi Hoek at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the clone() function of hoek versions prior to 8.5.1 and 9.x prior to 9.0.3. When an object containing a "__proto__" key is passed to clone(), the key is incorrectly converted to a prototype property instead of being cloned as a normal object key. Exploitation requires an attacker to inject a malicious object into a code path where clone() is called on untrusted input; in hapi applications, the framework's input validation typically prevents such objects from reaching clone(). The patch, available in versions 8.5.1 and 9.0.3, properly handles the "__proto__" key as a regular property during cloning.

Affected products

  • hapi hoek prior to 8.5.1; 9.x prior to 9.0.3
  • hapi @hapi/hoek prior to 8.5.1; 9.x prior to 9.0.3

Identifiers

  • CVE-2020-36604
  • GHSA-c429-5p7v-vgjp

Timeline

  • 2020-02-08: disclosed: Issue #352 opened in hapijs/hoek repository
  • 2022-09-23: advisory: NVD published CVE-2020-36604
  • 2022-09-25: advisory: GitHub advisory GHSA-c429-5p7v-vgjp published
  • 2022-09-25: patched: Patch available in versions 8.5.1 and 9.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.