PT-2018-16152 · Npm · Hoek

Holyvier · Published 2018-03-30 · Updated 2019-10-09 · CVE-2018-3728

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hoek versions prior to 4.2.1 hoek versions 5.0.x prior to 5.0.3

Description The issue affects the merge and applyToDefaults functions in the hoek node module, allowing a malicious user to modify the prototype of "Object" via proto. This can lead to the addition or modification of an existing property that will exist on all objects, potentially causing a denial of service. The vulnerability can be exploited when an unvalidated payload containing the proto property is provided to the affected functions.

Recommendations Update to version 4.2.1 or later. Update to version 5.0.3 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-471

CWE-1321

Related Identifiers

CVE-2018-3728

GHSA-JP4X-W63M-7WGM

RHSA-2018:1263

Affected Products

Hoek

References · 20

• 🔥 https://snyk.io/vuln/npm:hoek:20180212 · Exploit
• 🔥 https://hackerone.com/reports/310439 · Exploit
• https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-3728 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3728 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1264 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1263 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-3728 · Security Note
• https://ubuntu.com/security/CVE-2018-3728 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3728 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp4x-w63m-7wgm · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3728 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3728 · Vendor Advisory
• https://github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df · Note
• https://github.com/hapijs/hoek · Note