CVE Vulnerabilities

CVE-2020-7774

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Published: Nov 17, 2020 | Modified: Dec 02, 2022
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7.3 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Ubuntu
LOW

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

Name Vendor Start Version End Version
Y18n Y18n_project * 3.2.2 (excluding)
Y18n Y18n_project 5.0.0 (including) 5.0.5 (excluding)
Y18n Y18n_project 4.0.0 (including) 4.0.0 (including)
Red Hat Enterprise Linux 8 RedHat nodejs:12-8030020201124152102.229f0a1c *
Red Hat Enterprise Linux 8 RedHat nodejs:10-8030020210118191659.229f0a1c *
Red Hat Enterprise Linux 8 RedHat nodejs:14-8030020210126165503.229f0a1c *
Red Hat OpenShift Container Platform 4.7 RedHat openshift4/ose-grafana:v4.7.0-202102130115.p0 *
Red Hat OpenShift Container Platform 4.8 RedHat openshift4/ose-thanos-rhel8:v4.8.0-202106291913.p0.git.c358e96.assembly.stream *
Red Hat OpenShift Container Storage 4.7.0 on RHEL-8 RedHat ocs4/mcg-core-rhel8:5.7.0-60.2c1fdb0.5.7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs12-nodejs-0:12.19.1-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-0:14.15.4-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs10-nodejs-0:10.23.1-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs12-nodejs-0:12.19.1-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs14-nodejs-0:14.15.4-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs10-nodejs-0:10.23.1-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs12-nodejs-0:12.19.1-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs14-nodejs-0:14.15.4-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs10-nodejs-0:10.23.1-2.el7 *
Node-y18n Ubuntu bionic *
Node-y18n Ubuntu groovy *
Node-y18n Ubuntu hirsute *
Node-y18n Ubuntu impish *
Node-y18n Ubuntu kinetic *
Node-y18n Ubuntu trusty *
Node-y18n Ubuntu upstream *

Extended Description

By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). This weakness is usually exploited by using a special attribute of objects called proto, constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.

Potential Mitigations

References