Executive brief
web3-utils is a utility library used by Web3 applications to handle data formatting and object merging. A prototype pollution vulnerability in the format and mergeDeep functions allows attackers to manipulate object prototypes through specially crafted input, potentially altering the behavior of all objects inheriting from the affected prototype and disrupting application availability.
Technical details
The vulnerability is a prototype pollution (CWE-1321) issue in the web3-utils library versions before 4.2.1, affecting the format and mergeDeep utility functions. The root cause is insecure recursive merge logic that fails to properly validate or sanitize object property assignments during deep merge operations. An attacker can exploit this by passing specially crafted input to these functions via network, with no authentication or user interaction required. Successful exploitation allows modification of the prototype chain, potentially affecting all objects inheriting from the polluted prototype. The vulnerability was fixed in version 4.2.1.
Affected products
- web3 web3-utils before 4.2.1
Timeline
- 2024-03-25: disclosed
- 2024-03-25: patched: Fix available in version 4.2.1
- 2024-03-27: other: Advisory withdrawn as duplicate of GHSA-2g4c-8fpm-c46v