CVE-2018-3728: Prototype Pollution in hoek
(updated )
Versions of hoek
prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge
function, and the applyToDefaults
and applyToDefaultsWithShallow
functions which leverage merge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__
property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
References
- access.redhat.com/errata/RHSA-2018:1263
- access.redhat.com/errata/RHSA-2018:1264
- github.com/advisories/GHSA-jp4x-w63m-7wgm
- github.com/hapijs/hoek
- github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee
- github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df
- hackerone.com/reports/310439
- nvd.nist.gov/vuln/detail/CVE-2018-3728
- snyk.io/vuln/npm:hoek:20180212
- web.archive.org/web/20200227131737/https://www.securityfocus.com/bid/103108
Code Behaviors & Features
Detect and mitigate CVE-2018-3728 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →