CVE-2018-3721: Input Validation
Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allows modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property leading to potential denial of service.
Upstream patch:
https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
References:
https://snyk.io/vuln/npm:lodash:20180130 https://hackerone.com/reports/310443
Other sources
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.5 or later.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Node.js lodash vulnerability?
The vulnerability ID for this Node.js lodash vulnerability is CVE-2018-3721.
What is the severity level of CVE-2018-3721?
The severity level of CVE-2018-3721 is medium (5.3).
How does the vulnerability in Node.js lodash module manifest?
The vulnerability in Node.js lodash module allows a remote attacker to bypass security restrictions by modifying the prototype of 'Object' via '__proto__', causing the addition or modification of an existing property.
What is the affected software for CVE-2018-3721?
The affected software for CVE-2018-3721 includes the lodash node module before version 4.17.5 and IBM Security Verify Governance before version 10.0.
How can I fix the vulnerability in Node.js lodash module?
To fix the vulnerability in Node.js lodash module, update the lodash package to version 4.17.5 or higher.