PT-2020-6062 · Npm+5 · Minimist+5
Published
2020-03-11
·
Updated
2022-04-22
·
CVE-2020-7598
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
minimist versions prior to 1.2.2
minimist versions prior to 0.2.1
Description
The issue is related to the minimist library, which is vulnerable to prototype pollution. This occurs because arguments are not properly sanitized, allowing an attacker to modify the prototype of
Object, resulting in the addition or modification of an existing property that will exist on all objects. For example, parsing the argument -- proto .y=Polluted adds a y property with value Polluted to all objects. The argument -- proto =Polluted raises an uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to minimist.Recommendations
For versions prior to 0.2.1, upgrade to version 0.2.1 or later.
For versions prior to 1.2.2, upgrade to version 1.2.3 or later.
As a temporary workaround, consider restricting the use of the
minimist library until a patch is applied, especially in scenarios where argument control is limited.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Minimist