PT-2022-20532 · Unknown · Underscore.Deep

Published 2022-06-28 · Updated 2022-07-08 · CVE-2022-31106

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions underscore.deep versions prior to 0.5.3

Description The issue affects a collection of Underscore mixins that operate on nested objects, allowing an attacker to craft a malicious payload and pass it to deepFromFlat, which would pollute any future Objects created. Users with deepFromFlat or deepPick in their code are at risk due to the dependency of deepPick on deepFromFlat.

Recommendations For versions prior to 0.5.3, upgrade to version 0.5.3 as soon as possible. For users unable to upgrade, modify deepFromFlat to prevent specific keywords as a mitigation measure.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2022-31106

GHSA-8J79-HFJ5-F2XM

Affected Products

Underscore.Deep

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31106.json · Exploit
• 🔥 https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm · Exploit
• https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31106 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31106 · Vendor Advisory
• https://t.me/cibsecurity/45326 · Telegram Post