Find, fix and prevent vulnerabilities in your code.
high severity
ignored
- Vulnerable module: lodash.set
- Introduced through: snyk-resolve-deps@4.7.3
-
Ignored path
∗
-
Expires
in a month
Reason
: No upgrade path currently availableThis issue was ignored via the project's .snyk policy file. To unignore it, update the policy file.
Detailed paths
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-resolve-deps@4.7.3 › lodash.set@4.3.2
Overview
lodash.set is a lodash method _.set exported as a Node.js module.
Affected versions of this package are vulnerable to Prototype Pollution via the set
and setwith
functions due to improper user input sanitization.
Note
lodash.set
is not maintained for a long time. It is recommended to use lodash
library, which contains the fix since version 4.17.17.
PoC
lod = require('lodash')
lod.set({}, "__proto__[test2]", "456")
console.log(Object.prototype)
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__
, constructor
and prototype
. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype
are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Object
recursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__
defined with Object.defineProperty()
, the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object
and the source of Object
as defined by the attacker. Properties are then copied on the Object
prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source)
.
lodash
and Hoek
are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue
. myValue
is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
Type | Origin | Short description |
---|---|---|
Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf ). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object . In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr) . In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin , then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true , they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype)
.Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)
), breaking the prototype chain and preventing pollution.As a best practice use
Map
instead ofObject
.
For more information on this vulnerability type:
Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
There is no fixed version for lodash.set
.
References
medium severity
- Vulnerable module: inflight
- Introduced through: glob@7.2.3, rimraf@2.7.1 and others
Detailed paths
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-mvn-plugin@3.5.0 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-sbt-plugin@2.18.1 › tmp@0.1.0 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-go-plugin@1.23.0 › tmp@0.2.1 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-gradle-plugin@4.1.0 › tmp@0.2.1 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-python-plugin@2.1.1 › tmp@0.2.1 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
Overview
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres
function due to improperly deleting keys from the reqs
object after execution of callbacks. This behavior causes the keys to remain in the reqs
object, which leads to resource exhaustion.
Exploiting this vulnerability results in crashing the node
process or in the application crash.
Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.
To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.
PoC
const inflight = require('inflight');
function testInflight() {
let i = 0;
function scheduleNext() {
let key = `key-${i++}`;
const callback = () => {
};
for (let j = 0; j < 1000000; j++) {
inflight(key, callback);
}
setImmediate(scheduleNext);
}
if (i % 100 === 0) {
console.log(process.memoryUsage());
}
scheduleNext();
}
testInflight();
Remediation
There is no fixed version for inflight
.
References
medium severity
- Vulnerable module: shescape
- Introduced through: @snyk/snyk-cocoapods-plugin@2.5.3, @snyk/snyk-hex-plugin@1.1.6 and others
Detailed paths
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › @snyk/snyk-cocoapods-plugin@2.5.3 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › @snyk/snyk-hex-plugin@1.1.6 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-gradle-plugin@4.1.0 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-mvn-plugin@3.5.0 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-python-plugin@2.1.1 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-sbt-plugin@2.18.1 › shescape@1.6.1
Overview
shescape is a simple shell escape library
Affected versions of this package are vulnerable to Improper Neutralization due to possible escaping the wrong shell, thus allowing attackers to bypass protections. Note: you are only vulnerable if you are using this package on Windows in a threaded context.
PoC
// vulnerable.js
import { exec } from "node:child_process";
import { Worker, isMainThread } from 'node:worker_threads';
import * as shescape from "shescape";
if (isMainThread) {
// 1. Something like a worker thread must be used. The reason being that they
// unexpectedly change environment variable names on Windows.
new Worker("./vulnerable.js");
} else {
// 2. Example configuration that's problematic. In this setup example the
// expected default system shell is CMD. We configure the use of PowerShell.
// Shescape will fail to look up PowerShell and default to escaping for CMD
// instead, resulting in the vulnerability.
const options = {
shell: "powershell",
interpolation: true,
};
// 3. Using shescape to protect against attacks, this is correct.
const escaped = shescape.escape("&& ls", options);
// 4. Invoking a command with the escaped user input, this is vulnerable in
// this case.
exec(`echo Hello ${escaped}`, options, (error, stdout) => {
if (error) {
console.error(`An error occurred: ${error}`);
} else {
console.log(stdout);
}
});
}
Remediation
Upgrade shescape
to version 1.7.4 or higher.
References
medium severity
- Vulnerable module: shescape
- Introduced through: @snyk/snyk-cocoapods-plugin@2.5.3, @snyk/snyk-hex-plugin@1.1.6 and others
Detailed paths
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › @snyk/snyk-cocoapods-plugin@2.5.3 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › @snyk/snyk-hex-plugin@1.1.6 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-gradle-plugin@4.1.0 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-mvn-plugin@3.5.0 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-python-plugin@2.1.1 › shescape@1.6.1
-
Introduced through: snyk@snyk/snyk#79e8b2bb9ee91289152984262a8f754a1003ebc4 › snyk-sbt-plugin@2.18.1 › shescape@1.6.1
Overview
shescape is a simple shell escape library
Affected versions of this package are vulnerable to Information Exposure such that an attacker may be able to get read-only access to environment variables.
Note:
This impact users of Shescape:
- On Windows using the Windows Command Prompt (i.e.
cmd.exe
), and - Using
quote
/quoteAll
orescape
/escapeAll
with theinterpolation
option set totrue
.
Workaround
Users who are unable to upgrade to the fixed version can remove all instances of %
from user input, either before or after using Shescape.
PoC
import * as cp from "node:child_process";
import * as shescape from "shescape";
// 1. Prerequisites
const options = {
shell: "cmd.exe",
// Or
shell: undefined, // Only if the default shell is CMD
// And
interpolation: true, // Only applies to `escape` and `escapeAll` usage
}
// 2. Attack (one of many)
const payload = "%PATH%";
// 3. Usage
let escapedPayload;
escapedPayload = shescape.quote(payload, options);
// Or
escapedPayload = shescape.quoteAll([payload], options);
// Or
escapedPayload = shescape.escape(payload, options);
// Or
escapedPayload = shescape.escapeAll([payload], options);
// And (example)
const result = cp.execSync(`echo Hello ${escapedPayload}`, options);
// 4. Impact
console.log(result.toString());
// Outputs "Hello" followed by the contents of the PATH environment variable
Remediation
Upgrade shescape
to version 1.7.1 or higher.