PT-2020-6069 · Yargs+4 · Yargs-Parser+4
Published
2020-03-16
·
Updated
2022-11-15
·
CVE-2020-7608
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
yargs-parser versions prior to 13.1.2
yargs-parser versions prior to 15.0.1
yargs-parser versions prior to 18.1.1
Description
The issue is related to the
yargs-parser library, which can be tricked into adding or modifying properties of Object.prototype using a " proto " payload. This can lead to a prototype pollution attack, allowing a remote attacker to implement an attack. The vulnerability is caused by the lack of proper sanitization of arguments, enabling an attacker to modify the prototype of Object. For example, parsing the argument --foo. proto .bar baz adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.Recommendations
Upgrade to version 13.1.2 or later.
Upgrade to version 15.0.1 or later.
Upgrade to version 18.1.1 or later.
Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Rocky Linux
Yargs-Parser