Executive brief
The deep.assign library, a tool used by developers to merge complex data objects in JavaScript applications, contains a security flaw known as prototype pollution. An attacker can exploit this to inject malicious properties into the application's core data structures. This can lead to a variety of serious outcomes, including application crashes, unauthorized access to sensitive data, or the ability to execute unauthorized commands on the server.
Technical details
The deep.assign npm package (version 0.0.0-alpha.0) is vulnerable to Prototype Pollution (CWE-1321). The vulnerability exists in the deep assignment logic which fails to properly sanitize or restrict keys such as '__proto__'. An attacker can provide a specially crafted JSON object to the deepAssign function that modifies the global Object prototype. This can be exploited over the network without authentication to cause a Denial of Service (DoS), disclose sensitive information, or potentially achieve Remote Code Execution (RCE) depending on how the polluted properties are used by the application. As of the advisory, there is no known patched version.
Affected products
- janbialostok deep.assign 0.0.0-alpha.0
Timeline
- 2021-09-06: disclosed: Issue reported on GitHub repository
- 2022-06-30: advisory: NVD published CVE-2021-40663
- 2022-07-01: advisory: GitHub Advisory published