PT-2022-9400 · Unknown · Putil-Merge

Abdullah Alhamdan + 1 · Published 2022-02-04 · Updated 2022-02-09 · CVE-2021-23470

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions putil-merge versions prior to 3.8.0

Description The issue arises from the merge() function not checking the values passed into its argument, allowing an attacker to supply a malicious value by adjusting it to include the constructor property. This vulnerability is a result of an incomplete fix.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider disabling the merge() function until a patch is available. Restrict access to the merge() function to minimize the risk of exploitation. Avoid using the constructor property in the affected function until the issue is resolved.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23470

GHSA-4G77-CVGW-GRVW

SNYK-JS-PUTILMERGE-2391487

Affected Products

Putil-Merge

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487 · Exploit
• https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23470 · Security Note
• https://osv.dev/vulnerability/GHSA-4g77-cvgw-grvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23470 · Vendor Advisory
• https://github.com/panates/putil-merge · Note
• https://t.me/cvenotify/26300 · Telegram Post
• https://t.me/cibsecurity/36873 · Telegram Post