{"id":"CVE-2021-25944","aliases":[],"url":"https://o3.security/vulnerability/CVE-2021-25944","summary":"deep-defaults vulnerable to prototype pollution","details":"### Overview\nPrototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.\n\n### Details\nThe NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.\n\n### PoC\nThe `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object's own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as \"Yes! Its Polluted\" as it had been polluted.\n\n```js\nvar deepDefaults = require(\"deep-defaults\")\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"Yes! Its Polluted\"}}';\nvar obj ={};\nconsole.log(\"Before : \" + {}.polluted);\ndeepDefaults(obj, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + {}.polluted);\n```","published":"2022-05-24T19:03:10Z","modified":"2024-04-22T23:44:02.619075Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.02961,"percentile":0.86447,"asOf":"2026-09-14"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"deep-defaults","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25944"},{"type":"WEB","url":"https://github.com/d5/deep-defaults"},{"type":"WEB","url":"https://github.com/d5/deep-defaults/blob/321d0e2231aa807d54e7f95d75c22048a806923f/lib/index.js#L16"},{"type":"WEB","url":"https://web.archive.org/web/20210525211925/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25944"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-04-22T23:44:02.619075Z"}}