ghsa-jp4x-w63m-7wgm
Vulnerability from github
Published
2018-04-26 15:25
Modified
2023-09-13 19:42
Severity ?
Summary
Prototype Pollution in hoek
Details
Versions of hoek prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__ property.
This can be demonstrated like so:
```javascript var Hoek = require('hoek'); var malicious_payload = '{"proto":{"oops":"It works !"}}';
var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops); ```
This type of attack can be used to overwrite existing properties causing a potential denial of service.
Recommendation
Update to version 4.2.1, 5.0.3 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hoek"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "hoek"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3728"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:43:55Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require(\u0027hoek\u0027);\nvar malicious_payload = \u0027{\"__proto__\":{\"oops\":\"It works !\"}}\u0027;\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.\n\n\n## Recommendation\n\nUpdate to version 4.2.1, 5.0.3 or later.",
"id": "GHSA-jp4x-w63m-7wgm",
"modified": "2023-09-13T19:42:48Z",
"published": "2018-04-26T15:25:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3728"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/310439"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1263"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1264"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jp4x-w63m-7wgm"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/npm:hoek:20180212"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/566"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103108"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in hoek"
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.