PT-2018-16152 · Npm · Hoek

Holyvier · Publicado 2018-03-30 · Atualizado 2019-10-09 · CVE-2018-3728

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hoek versions prior to 4.2.1 hoek versions 5.0.x prior to 5.0.3

Description The issue affects the merge and applyToDefaults functions in the hoek node module, allowing a malicious user to modify the prototype of "Object" via proto. This can lead to the addition or modification of an existing property that will exist on all objects, potentially causing a denial of service. The vulnerability can be exploited when an unvalidated payload containing the proto property is provided to the affected functions.

Recommendations Update to version 4.2.1 or later. Update to version 5.0.3 or later.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-471

CWE-1321

Identificadores relacionados

CVE-2018-3728

GHSA-JP4X-W63M-7WGM

RHSA-2018:1263

Produtos afetados

Hoek

Referências · 20

• 🔥 https://snyk.io/vuln/npm:hoek:20180212 · Exploit
• 🔥 https://hackerone.com/reports/310439 · Exploit
• https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee · Correção
• https://github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df · Nota
• https://github.com/hapijs/hoek · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3728 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3728 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1264 · Aviso do Fabricante
• https://nodesecurity.io/advisories/566 · Nota
• https://access.redhat.com/errata/RHSA-2018:1263 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-3728 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-3728 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3728 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jp4x-w63m-7wgm · Aviso do Fabricante
• https://npmjs.com/advisories/566 · Nota