PT-2024-35459 · Unknown · @Intlify/Shared
Bobbie Goede
·
Published
2024-11-29
·
Updated
2024-12-02
·
CVE-2024-52810
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
@intlify/shared versions 10.0.4
Description
The issue is related to Prototype Pollution through the entry function(s)
lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. The consequences of this issue can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.Recommendations
For @intlify/shared version 10.0.4, upgrade to version 10.0.5 to resolve the issue.
As a temporary workaround, consider restricting the use of the
lib.deepCopy function until a patch is available.
Avoid using the Object.prototype setter in the affected lib.deepCopy function until the issue is resolved.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Intlify/Shared