Executive brief
deap is a JavaScript library for deep merging and extending objects. Versions before 1.0.1 are vulnerable to prototype pollution, allowing an attacker who controls input data to modify the Object prototype and inject properties that affect all objects in an application, potentially leading to unauthorized data manipulation or application behavior changes.
Technical details
The vulnerability is a prototype pollution flaw in deap's merge/extend utilities. When an attacker controls part of the object structure passed to these functions, they can inject a "__proto__" key to modify the Object prototype. The attack requires network-reachable input but no authentication. An attacker can inject or modify properties on all objects application-wide, potentially escalating to remote code execution or denial of service depending on how the affected application uses the polluted properties. Upgrade to deap version 1.0.1 or later to fix this issue.
Affected products
- deap deap <1.0.1
Timeline
- 2018-04-15: disclosed
- 2018-04-17: patched: version 1.0.1 released
- 2019-05-31: advisory