PT-2023-20517 · Unknown · Underscore-Keypath

Peng Zhou + 1 · Published 2023-08-01 · Updated 2023-08-04 · CVE-2023-26139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions underscore-keypath versions 0.0.11 and later

Description The issue arises from improper input sanitization in the setProperty() function, allowing the usage of arguments like proto and leading to Prototype Pollution. This can be exploited due to the lack of proper input validation.

Recommendations For versions 0.0.11 and later, consider disabling the setProperty() function until a patch is available to prevent exploitation. Restrict the use of the name argument in the setProperty() function to minimize the risk of Prototype Pollution. Avoid using arguments like proto in the setProperty() function until the issue is resolved.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-26139

GHSA-GPVC-MX6G-CCHV

Affected Products

Underscore-Keypath

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-26139 · Security Note
• https://osv.dev/vulnerability/GHSA-gpvc-mx6g-cchv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26139 · Vendor Advisory
• https://github.com/jeeeyul/underscore-keypath · Note
• https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252 · Note
• https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714 · Note
• https://t.me/cibsecurity/67496 · Telegram Post
• https://t.me/cvenotify/55650 · Telegram Post