CVE-2020-7644

Vulnerability

Overview

CVE-2020-7644 is a Prototype Pollution vulnerability discovered in the JavaScript package fun-map up to version 3.3.1. The flaw resides in the assocInM function, which does not properly sanitize object keys containing __proto__. This allows an attacker to inject arbitrary properties into Object.prototype, polluting the prototype chain of all objects in the runtime [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious object with a __proto__ property that contains attacker-controlled nested properties. When the assocInM function processes this input, it merges the __proto__ payload into the global object prototype. No authentication is required if the application processes unsanitized user input through this function. The attack requires the application to use the vulnerable assocInM function on user-supplied data, which is a common pattern in recursive merge or deep assign operations [1][2].

Impact

Successful exploitation grants the attacker the ability to globally modify the behavior of all objects in the JavaScript runtime. This can lead to denial of service (DoS) by overriding critical methods, property injection that alters application logic, or even remote code execution in some environments if combined with other gadget chains. The impact is amplified because prototype pollution can affect all objects, not just those directly processed [1].

Mitigation

The package maintainer released a fix in version 3.4.0 (post-fix) that sanitizes keys to prevent __proto__ from being set. Users should upgrade to version 3.4.0 or later. If immediate upgrade is not possible, the workaround is to avoid using assocInM with untrusted input or to manually filter out __proto__ keys before processing [1][2].