Listen to this Post
The vulnerability in deephas npm package version 1.0.7 stems from insecure validation in the `add()` and `indexer()` functions within deepHas.js. These functions attempt to prevent prototype pollution by checking property ownership using `Object.hasOwnProperty` and scanning for forbidden strings like ‘prototype’ or ‘proto‘ with String.prototype.indexOf. However, an attacker can bypass these checks by first polluting the global prototype chain. By modifying `Object.prototype.hasOwnProperty` to always return true, or altering `String.prototype.indexOf` to always return -1, the validation mechanisms are neutralized. Consequently, when `deephas.set` is called with attacker-controlled paths such as ‘constructor.prototype.polluted’ or ‘proto.polluted’, the function incorrectly processes these as legitimate property assignments. This injects properties directly into Object.prototype, polluting the prototype chain for all objects. The pollution occurs because the bypassed checks fail to intercept the malicious payloads during property setting. This issue is runtime-agnostic, affecting Node.js, Deno, and Bun environments, and can lead to severe security consequences like authentication bypass or remote code execution if polluted properties reach dangerous sinks.
Platform: deephas npm package
Version: 1.0.7
Vulnerability: Prototype pollution
Severity: Critical
date: Unknown
Prediction: Patched v1.0.8
What Undercode Say:
npm install [email protected]
Object.prototype.hasOwnProperty = () => true;
const dh = require(‘deephas’);
dh.set(obj, ‘constructor.prototype.polluted’, ‘yes’);
String.prototype.indexOf = () => -1;
dh.set(obj, ‘__proto__.polluted’, ‘yes’);
How Exploit:
Pollute global prototypes.
Bypass validation checks.
Inject malicious property paths.
Protection from this CVE
Update to version 1.0.8.
Sanitize input paths.
Use object property safeguards.
Impact:
Authentication bypass possible.
Denial of service risk.
Remote code execution potential.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
