CVE-2018-3751

描述

All versions of `merge-recursive` are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via `__proto__` causing the addition or modification of an existing property. Proof of concept: ```js var merge = require('merge-recursive').recursive; var malicious_payload = '{"__proto__":{"oops":"It works !"}}'; var a = {}; console.log("Before : " + a.oops); merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops); ``` ## Recommendation There is currently no fix available.

如何修補 CVE-2018-3751

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2018-3751 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 0.0.3

CVSS 分數

參考連結(4)

• ADVISORYgithub.com/advisories/GHSA-cvxm-f295-x957
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-3751
• WEBhackerone.com/reports/311337
• WEBwww.npmjs.com/advisories/715