Executive brief
lodash is a popular JavaScript utility library used in thousands of applications to simplify data manipulation. This vulnerability allows attackers to pollute the Object prototype when using certain lodash functions with user-controlled input, potentially leading to denial of service or code execution across an application. Affected applications may crash or behave unexpectedly when the polluted prototype properties interfere with normal object operations.
Technical details
This is a prototype pollution vulnerability in lodash functions (pick, set, setWith, update, updateWith, and zipObjectDeep) that occurs when property identifiers are derived from user-supplied input. An attacker can craft malicious property paths that modify the Object.prototype, injecting properties that propagate to all JavaScript objects in the runtime. The vulnerability requires the application to manipulate objects based on user-provided property values or arrays; no authentication is needed, and it is reachable over the network. Exploitation can cause denial of service through object pollution or, under specific application circumstances, achieve arbitrary code execution. Patches are available in lodash 4.17.19 and later versions.
Affected products
- lodash lodash 3.7.0 to 4.17.18
- lodash lodash-es 3.7.0 to 4.17.19
- lodash lodash.pick 4.0.0 to 4.4.0
- lodash lodash.set 3.7.0 to 4.3.2
- lodash lodash.setwith all versions to 4.3.2
- lodash lodash.update all versions to 4.10.2
- lodash lodash.updatewith all versions to 4.10.2
- lodash lodash-rails 3.7.0 to 4.17.18
Timeline
- 2020-07-15: disclosed
- 2020-07-15: patched: lodash 4.17.19 and lodash-es 4.17.20 released