Executive brief
lodash.defaultsdeep is a JavaScript utility library function used to merge configuration objects in applications. A flaw in how it handles deep merging allows attackers to inject properties into JavaScript's Object prototype, potentially affecting all objects in an application and leading to unintended behavior or security bypasses across the codebase.
Technical details
The vulnerability is a prototype pollution flaw in versions of lodash.defaultsdeep before 4.6.1. The mergeWith function fails to properly sanitize merge operations, allowing attackers to inject malicious properties via specially crafted objects using the {constructor: {prototype: {...}}} pattern. This attack vector does not require authentication and can be triggered if the application uses defaultsdeep to merge untrusted user input with configuration objects. A successful exploit pollutes the Object prototype, causing all objects to inherit the injected properties, potentially enabling property injection attacks, security control bypasses, or denial of service conditions.
Affected products
- lodash lodash.defaultsdeep < 4.6.1
Timeline
- 2020-09-03: disclosed