CVE-2020-8203: Input Validation
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.
Other sources
Prototype pollution attack when using .zipObjectDeep in lodash <= 4.17.15.
Reference: https://hackerone.com/reports/712065
— Red Hat
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20.
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.
This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8203?
CVE-2020-8203 is a vulnerability caused by a prototype pollution attack in the lodash module before version 4.17.20.
What is the severity of CVE-2020-8203?
CVE-2020-8203 has a severity keyword of 'high' and a severity value of 7.
How can I exploit CVE-2020-8203?
To exploit CVE-2020-8203, a remote attacker can use the merge, mergeWith, and defaultsDeep functions in lodash to inject properties onto Object.prototype and potentially crash the server or execute arbitrary code.
How do I fix CVE-2020-8203?
To fix CVE-2020-8203, update the lodash module to version 4.17.20 or newer.
Where can I find more information about CVE-2020-8203?
You can find more information about CVE-2020-8203 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/183560), [IBM Support](https://www.ibm.com/support/pages/node/6570957), [CVE](https://www.cve.org/CVERecord?id=CVE-2020-8203), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8203), [HackerOne](https://hackerone.com/reports/712065), [npmjs](https://www.npmjs.com/advisories/1523).