Executive brief
putil-merge is a JavaScript library used to merge objects in Node.js applications. A prototype pollution vulnerability in versions 1.0.0 through 3.6.6 allows attackers to manipulate the behavior of all objects in an application by polluting the prototype chain. This could lead to denial of service or remote code execution, potentially compromising the confidentiality, integrity, and availability of the affected application.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in putil-merge versions 1.0.0 through 3.6.6, where the merge function fails to properly validate and sanitize object keys during merging operations. This allows an attacker to inject malicious properties into Object.prototype or other built-in prototypes. The attack is network-reachable and requires no authentication or user interaction, as it can be triggered by providing specially crafted input to any application using the vulnerable merge function. A successful exploit can lead to denial of service or potentially remote code execution. The vulnerability is fixed in version 3.7.0.
Affected products
- putil putil-merge 1.0.0 through 3.6.6
Timeline
- 2021-07-14: disclosed
- 2021-12-10: advisory
- 2021: patched: Fixed in version 3.7.0