search

mahawiki / BackToBasics-Hacktoberfest

Hacktoberfest community repository. In this repository, you can find all the resources you need to get start your career in tech industry.
GNU General Public License v3.0
6 stars 7 forks source link

[ VULNERABILITY ] Prototype pollution in lodash #2

Closed APratham closed 3 years ago

APratham commented 3 years ago

Describe the vulnerability Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

Where is it? Upgrade lodash to 4.17.19 or later in ../microservices/package-lock.json

Risk involved This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Database CVE-2020-8203

Expected behavior The containers will still compile there is no issue with that. But the application will be vulnerable to prototype pollution.

Additional context https://www.npmjs.com/advisories/1523 https://nvd.nist.gov/vuln/detail/CVE-2020-8203 https://hackerone.com/reports/712065 https://security.netapp.com/advisory/ntap-20200724-0006/

APratham commented 3 years ago

Resolved