PT-2022-9415 · Extend2 · Extend2

Bob Wombat Hogg · Published 2022-01-07 · Updated 2022-01-13 · CVE-2021-23568

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions extend2 versions prior to 1.0.1

Description The issue concerns Prototype Pollution via the extend function due to an unsafe recursive merge. This allows for potential manipulation of the prototype, which can lead to various security issues.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the extend function until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23568

GHSA-GJM5-83CW-P3P2

SNYK-JS-EXTEND2-2320315

Affected Products

Extend2

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-EXTEND2-2320315 · Exploit
• https://github.com/eggjs/extend2/pull/2 · Patch
• https://github.com/eggjs/extend2/commit/aa332a59116c8398976434b57ea477c6823054f8 · Patch
• https://osv.dev/vulnerability/GHSA-gjm5-83cw-p3p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23568 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23568 · Vendor Advisory
• https://github.com/eggjs/extend2 · Note
• https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60 · Note
• https://t.me/cvenotify/25442 · Telegram Post
• https://t.me/cibsecurity/35169 · Telegram Post