PT-2020-19777 · Firebase · @Firebase/Util

Published 2020-11-16 · Updated 2021-05-18 · CVE-2020-7765

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @firebase/util versions prior to 0.3.4

Description This issue relates to the deepExtend function within the DeepCopy.ts file. Depending on user input, an attacker can overwrite and pollute the object prototype of a program.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the deepExtend function within the DeepCopy.ts file until a patch is applied. Avoid using user input that could potentially overwrite and pollute the object prototype of a program.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-7765

GHSA-FPM5-VV97-JFWG

SNYK-JS-FIREBASEUTIL-1038324

Affected Products

@Firebase/Util

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324 · Exploit
• https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada · Patch
• https://github.com/firebase/firebase-js-sdk/pull/4001 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7765 · Security Note
• https://osv.dev/vulnerability/GHSA-fpm5-vv97-jfwg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7765 · Vendor Advisory
• https://t.me/cvenotify/5604 · Telegram Post
• https://t.me/cibsecurity/16340 · Telegram Post