PT-2020-16966 · Deep-Set · Deep-Set

Published 2020-12-29 · Updated 2022-05-24 · CVE-2020-28276

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions deep-set versions 1.0.0 through 1.0.1

Description The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. This is because the deepSet() function does not check the type of object before assigning a value to a property, enabling an attacker to create non-existent properties or manipulate existing ones.

Recommendations For deep-set versions 1.0.0 through 1.0.1, consider disabling the deepSet() function until a patch is available to prevent potential exploitation. Restrict the use of the deepSet() function to minimize the risk of denial of service or remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-28276

GHSA-WGXM-RG53-H2C6

Affected Products

Deep-Set

References · 9

• 🔥 https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39 · Exploit
• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2020-28276 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28276 · Security Note
• https://osv.dev/vulnerability/GHSA-wgxm-rg53-h2c6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28276 · Vendor Advisory
• https://github.com/klaemo/deep-set · Note
• https://t.me/cvenotify/7919 · Telegram Post
• https://t.me/cvenotify/7890 · Telegram Post
• https://web.archive.org/web/20210320110509/https://whitesourcesoftware.com/vulnerability-database/CVE-2020-28276 · Note