CVE-2020-8203: Input Validation
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.
Other sources
Prototype pollution attack when using .zipObjectDeep in lodash <= 4.17.15.
Reference: https://hackerone.com/reports/712065
— Red Hat
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20.
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.
This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kialito a version that resolves this vulnerability.Fixed in 0:v1.12.10.redhat2-1.el7 - Upgrade
Upgrade
redhat/iorto a version that resolves this vulnerability.Fixed in 0:1.1.6-1.el8 - Upgrade
Upgrade
redhat/servicemeshto a version that resolves this vulnerability.Fixed in 0:1.1.6-1.el8 - Upgrade
Upgrade
redhat/servicemesh-cnito a version that resolves this vulnerability.Fixed in 0:1.1.6-1.el8 - Upgrade
Upgrade
redhat/servicemesh-grafanato a version that resolves this vulnerability.Fixed in 0:6.4.3-13.el8 - Upgrade
Upgrade
redhat/servicemesh-operatorto a version that resolves this vulnerability.Fixed in 0:1.1.6-2.el8 - Upgrade
Upgrade
redhat/servicemesh-prometheusto a version that resolves this vulnerability.Fixed in 0:2.14.0-14.el8 - Upgrade
Upgrade
redhat/cockpit-ovirtto a version that resolves this vulnerability.Fixed in 0:0.14.15-1.el8e - Upgrade
Upgrade
redhat/ovirt-engine-ui-extensionsto a version that resolves this vulnerability.Fixed in 0:1.2.3-1.el8e - Upgrade
Upgrade
redhat/ovirt-web-uito a version that resolves this vulnerability.Fixed in 0:1.6.4-1.el8e - Upgrade
Upgrade
npm/lodash-esto a version that resolves this vulnerability.Fixed in 4.17.20 - Upgrade
Upgrade
npm/lodashto a version that resolves this vulnerability.Fixed in 4.17.19 - Upgrade
Upgrade
redhat/nodejs-lodashto a version that resolves this vulnerability.Fixed in 4.17.16 - Upgrade
Upgrade
debian/node-lodashto a version that resolves this vulnerability.Fixed in 4.17.21+dfsg+~cs8.31.173-1Fixed in 4.17.21+dfsg+~cs8.31.198.20210220-9Fixed in 4.18.1+dfsg-3 - Upgrade
Upgrade
lodash/nodejs-lodashto a version that resolves this vulnerability.Fixed in 4.17.20 - Configuration
Ensure property identifiers (and arrays/keys) supplied to lodash functions `pick`, `set`, `setWith`, `update`, `updateWith`, and `zipObjectDeep` are not directly derived from user-provided property values/arrays to prevent prototype pollution (noting this applies to lodash versions listed in the report, including <= 4.17.15 and < 4.17.20).
lodash use of user-supplied property identifiers with functions pick, set, setWith, update, updateWith, zipObjectDeep = Do not allow user input to control property identifiers passed to pick/set/setWith/update/updateWith/zipObjectDeep
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8203?
CVE-2020-8203 is a vulnerability caused by a prototype pollution attack in the lodash module before version 4.17.20.
What is the severity of CVE-2020-8203?
CVE-2020-8203 has a severity keyword of 'high' and a severity value of 7.
How can I exploit CVE-2020-8203?
To exploit CVE-2020-8203, a remote attacker can use the merge, mergeWith, and defaultsDeep functions in lodash to inject properties onto Object.prototype and potentially crash the server or execute arbitrary code.
How do I fix CVE-2020-8203?
To fix CVE-2020-8203, update the lodash module to version 4.17.20 or newer.
Where can I find more information about CVE-2020-8203?
You can find more information about CVE-2020-8203 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/183560), [IBM Support](https://www.ibm.com/support/pages/node/6570957), [CVE](https://www.cve.org/CVERecord?id=CVE-2020-8203), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8203), [HackerOne](https://hackerone.com/reports/712065), [npmjs](https://www.npmjs.com/advisories/1523).