CVE-2019-10744

Vulnerability

Overview CVE-2019-10744 is a prototype pollution vulnerability in lodash versions prior to 4.17.12. The defaultsDeep function can be exploited by crafting an object with a constructor property that, when merged, pollutes Object.prototype, allowing attackers to add or modify properties of all JavaScript objects [1][4].

Exploitation

An attacker can supply a malicious JSON payload to a function that uses defaultsDeep to merge objects. No authentication is required if the application exposes an endpoint that accepts user-controlled objects for merging. The attack leverages JavaScript's prototype chain: because defaultsDeep recursively merges properties, a __proto__ or constructor.prototype key can be used to traverse to Object.prototype and inject arbitrary properties [2][4].

Impact

Successful exploitation can lead to property injection affecting the entire application. This can result in denial of service (by overriding critical properties), property tampering, or, in some contexts, remote code execution if the polluted properties influence subsequent operations [1][3][4]. Red Hat rated it as a moderate security issue in products like ovirt-web-ui [3].

Mitigation

The vulnerability is fixed in lodash version 4.17.12 [1][2]. Users should update to the latest version or apply the patch provided in the referenced pull request. No workarounds are available for older versions.