CVE-2021-4307 (published 2023-01-07T20:15Z)

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/Yomguithereal/baobab
commit_details: repo_url: https://github.com/Yomguithereal/baobab
author: huntr.dev | the place to protect open source
author_date: 2021-01-26 16:42:44+00:00
msg: Security Fix for Prototype Pollution (#511)
repository: repo_url: https://github.com/Yomguithereal/baobab
repo_name: Yomguithereal/baobab
description: JavaScript & TypeScript persistent and optionally immutable data tree with cursors.
repo_language: JavaScript
owner: Yomguithereal
file_changes: filename: helpers.js
change_type: ModificationType.MODIFY
diff: @@ -444,7 +444,8 @@ function merger(deep, ...objects) {
     for (k in t) {
       if (deep &&
           type.object(t[k]) &&
-          !(t[k] instanceof Monkey)) {
+          !(t[k] instanceof Monkey) &&
+          !(k === '__proto__' || k === 'constructor' || k === 'prototype')) {
         o[k] = merger(true, o[k] || {}, t[k]);
       }
       else {

programming_language: JavaScript
filename: helpers.ts
change_type: ModificationType.MODIFY
diff: @@ -94,6 +94,14 @@ describe('Helpers', function() {
         {one: {two: [3, 4]}, three: 3}
       );
     });
+
+    it('merge should not pollute object prototype.', function() {
+      const data = JSON.parse('{"__proto__": {"polluted": true}}');
+
+      deepMerge({}, data);
+
+      assert.equal(Object.keys(Object.prototype).includes('polluted'), false);
+    });
   });
 
   /**

programming_language: JavaScript