PT-2018-16172 · Node · Merge-Recursive

Holyvier · Published 2018-07-03 · Updated 2018-09-18 · CVE-2018-3751

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions merge-recursive versions <= 0.3.0

Description The issue allows an attacker to modify the prototype of Object, enabling the addition or modification of existing properties that will exist on all objects. This can occur when the attacker controls part of the structure passed to the utilities function in the merge-recursive node module. The vulnerability can be exploited when malicious user input is merged with another object, allowing the attacker to modify the prototype of Object via proto.

Recommendations For merge-recursive versions <= 0.3.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-3751

GHSA-CVXM-F295-X957

Affected Products

Merge-Recursive

References · 6

• 🔥 https://hackerone.com/reports/311337 · Exploit
• https://osv.dev/vulnerability/GHSA-cvxm-f295-x957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3751 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3751 · Security Note
• https://npmjs.com/advisories/715 · Note
• https://github.com/advisories/GHSA-cvxm-f295-x957 · Note