Executive brief
@75lb/deep-merge is a software library used by developers to combine complex data objects. A security flaw in this library allows an attacker to inject malicious data that modifies the fundamental behavior of the application. This can lead to a complete system takeover, data theft, or a total service outage.
Technical details
A prototype pollution vulnerability exists in @75lb/deep-merge versions up to and including 1.1.1. The library's merge implementation fails to properly sanitize special properties such as '__proto__' and 'constructor.prototype' when merging objects. By providing a specially crafted JSON payload, an unauthenticated remote attacker can inject properties into the global Object prototype. This can be leveraged to alter application logic, cause a denial of service (DoS), or potentially achieve remote code execution (RCE) depending on how the polluted properties are used by the application. The issue was addressed in version 1.1.2 by replacing the underlying merge logic.
Affected products
- 75lb @75lb/deep-merge <= 1.1.1
Timeline
- 2024-03-11: disclosed: Issue first reported on GitHub
- 2024-07-30: advisory: CVE-2024-38986 published
- 2024-07-31: patched: Version 1.1.2 released to fix the vulnerability