CVE-2021-25944: Deep defaults Deep-defaults Vulnerable To Prototype Pollution Vulnerability
CRITICALCVE-2021-25944 is a CRITICAL (CVSS 9.8) deep-defaults vulnerable to prototype pollution vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting Deep defaults libraries in the npm ecosystem. The issue involves deep-defaults vulnerable to prototype pollution. Remediation is available in the latest vendor maintenance releases.
CVE-2021-25944 at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2021-25944
To remediate this vulnerability, upgrade all affected Deep defaults dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install deep-defaults@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls deep-defaultsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2021-25944, inspect your project dependencies using npm:
npm ls deep-defaultsAnalyze the terminal output to locate any version of Deep defaults in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls deep-defaults command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In Deep defaults, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-25944 Affected Deep defaults Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
deep-defaults
|
npm |
≥ 1.0.0
≤ 1.0.5
|
|
References
Frequently Asked Questions
What is CVE-2021-25944?
Which Deep defaults versions are affected?
What version fixes CVE-2021-25944?
Is deep-defaults affected?
What is the CVSS score of CVE-2021-25944?
What CWE is associated with CVE-2021-25944?
How can I check npm dependencies for CVE-2021-25944?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-h6xg-rg33-9mf4",
"modified" : "2024-04-22T23:22:36Z",
"published" : "2022-05-24T19:03:10Z",
"aliases" : [ "CVE-2021-25944" ],
"summary" : "deep-defaults vulnerable to prototype pollution",
"details" : "### Overview\nPrototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.\n\n### Details\nThe NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.\n\n### PoC\nThe `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object's own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as \"Yes! Its Polluted\" as it had been polluted.\n\n```js\nvar deepDefaults = require(\"deep-defaults\")\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"Yes! Its Polluted\"}}';\nvar obj ={};\nconsole.log(\"Before : \" + {}.polluted);\ndeepDefaults(obj, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + {}.polluted);\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "deep-defaults"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.0.0"
}, {
"last_affected" : "1.0.5"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-25944"
}, {
"type" : "WEB",
"url" : "https://github.com/d5/deep-defaults"
}, {
"type" : "WEB",
"url" : "https://github.com/d5/deep-defaults/blob/321d0e2231aa807d54e7f95d75c22048a806923f/lib/index.js#L16"
}, {
"type" : "WEB",
"url" : "https://web.archive.org/web/20210525211925/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25944"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1321" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2024-04-22T23:22:36Z",
"nvd_published_at" : "2021-05-25T19:15:00Z"
}
}