Executive brief
@tsed/core is a TypeScript dependency injection framework used in Node.js applications. The deepExtend utility function contains a prototype pollution vulnerability that allows attackers to overwrite properties on the JavaScript Object prototype itself, potentially enabling unauthorized modification of application behavior or data exfiltration.
Technical details
The vulnerability exists in the deepExtend function within the utils directory of @tsed/core, which fails to properly validate object property assignments. An attacker who can control input passed to this function can inject malicious properties into the Object prototype chain, affecting all objects in the application. This is a prototype pollution vulnerability (CWE-1321, CWE-915) reachable via network-supplied user input. The vulnerability was fixed by using objectKeys() to restrict property enumeration and prevent prototype pollution attacks. Versions prior to 5.65.7 are affected.
Affected products
- TypedProject @tsed/core before 5.65.7
Timeline
- 2020-10-20: disclosed: CVE-2020-7748 published on NVD
- 2020-10-18: patched: Fix committed to prevent prototype pollution using objectKeys()
- 2021-05-10: advisory: GHSA-77xq-cpvg-7xm2 published