PT-2018-3979 · Node.Js · Extend

Asgerf · Publicado 2018-04-24 · Atualizado 2019-10-09 · CVE-2018-16492

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions extend versions prior to 2.0.2 extend versions prior to 3.0.2

Description A prototype pollution issue allows an attacker to inject arbitrary properties onto Object.prototype. This can be exploited by a remote attacker to add or modify properties of the object prototype, potentially affecting all objects. The extend module's extend() function is vulnerable, enabling attackers to modify the Object prototype.

Recommendations For extend version 2.x, upgrade to 2.0.2 or later. For extend version 3.x, upgrade to 3.0.2 or later.

Exploit

Correção

Special Elements Injection

Resource Exhaustion

Enumeração de Fraquezas

CWE-74

CWE-400

Identificadores relacionados

BDU:2024-01410

CVE-2018-16492

GHSA-QRMC-FJ45-QFC2

Produtos afetados

Extend

Referências · 21

• 🔥 https://hackerone.com/reports/381185 · Exploit
• https://github.com/github/advisory-database/pull/6695 · Nota
• https://github.com/justmoon/node-extend/pull/48 · Nota
• https://github.com/justmoon/node-extend/commit/0e68e71d93507fcc391e398bc84abd0666b28190 · Nota
• https://github.com/justmoon/node-extend · Nota
• https://github.com/dreamerslab/node.extend#readme · Nota
• https://bdu.fstec.ru/vul/2024-01410 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2018-16492 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qrmc-fj45-qfc2 · Aviso do Fabricante
• https://hackerone.com/reports/381185; · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-16492; · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-16492 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2021:3917; · Nota
• https://github.com/advisories/GHSA-qrmc-fj45-qfc2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16492 · Nota de Segurança