PT-2018-16174 · Node · Merge-Objects

Holyvier · Published 2018-07-03 · Updated 2018-09-18 · CVE-2018-3753

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions merge-objects node module versions <= 1.0.0

Description The utilities function in the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Recommendations For merge-objects node module versions <= 1.0.0, consider restricting the use of the utilities function until a patch is available, or ensure that the structure passed to this function is thoroughly validated to prevent manipulation by an attacker.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-20

Related Identifiers

CVE-2018-3753

GHSA-FP82-2H99-3FPP

Affected Products

Merge-Objects

References · 4

• 🔥 https://hackerone.com/reports/310706 · Exploit
• https://osv.dev/vulnerability/GHSA-fp82-2h99-3fpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3753 · Security Note