PT-2022-26043 · Unknown · Deep-Object-Diff

Carlos Bello · Published 2022-11-03 · Updated 2022-11-05 · CVE-2022-41713

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions deep-object-diff versions 1.1.0 through 1.1.5

Description The issue allows an external attacker to edit or add new properties to an object because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Recommendations For deep-object-diff versions 1.1.0 through 1.1.5, update to version 1.1.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the proto property in incoming JSON keys until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-41713

GHSA-653V-RQX9-J85P

Affected Products

Deep-Object-Diff

References · 10

• 🔥 https://fluidattacks.com/advisories/heldens · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41713 · Security Note
• https://osv.dev/vulnerability/GHSA-653v-rqx9-j85p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41713 · Vendor Advisory
• https://github.com/mattphillips/deep-object-diff · Note
• https://github.com/mattphillips/deep-object-diff/issues/85#issuecomment-1312450353 · Note
• https://github.com/mattphillips/deep-object-diff/pull/87/commits/55f9c3c70cf0d54cb30291e949fb8682fa3c5d9f · Note
• https://github.com/mattphillips/deep-object-diff/pull/87/commits/9576963b68b955e88610aa4f0c696a1aafc1119d · Note
• https://github.com/mattphillips/deep-object-diff/issues/85 · Note
• https://t.me/cibsecurity/52533 · Telegram Post