Prototype Pollution in async
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-43138US | high7.8 | — | ||
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/caolan/asyncPACKAGE
- https://github.com/caolan/async/blob/master/lib/internal/iterator.jsWEB
- https://github.com/caolan/async/blob/master/lib/mapValuesLimit.jsWEB
- https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264WEB
- https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2WEB
- https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66dWEB
- https://github.com/caolan/async/compare/v2.6.3...v2.6.4WEB
- https://github.com/caolan/async/pull/1828WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan