CVE-2024-38990

An attacker with low-privilege access can call the `mergeDeep` function with a crafted object containing the special property `__proto__` [ref_id=1]. Because the function recursively merges properties without filtering `__proto__`, it pollutes `Object.prototype` with attacker-controlled values [CWE-94]. This can alter the behavior of all objects inheriting from the affected prototype, potentially leading to denial of service, remote code execution, or cross-site scripting depending on available gadgets [ref_id=1]. The attack is network-reachable and requires no user interaction.

The vulnerable function is `mergeDeep` in the `@abip/sp-common` package version 0.5.4 [ref_id=1]. The function does not sanitize or block the `__proto__` property key during deep merge operations, allowing prototype pollution to occur.

No patch is published in the bundle. The advisory [ref_id=1] identifies that the `mergeDeep` function fails to block or sanitize the `__proto__` property key during deep merge operations. To remediate, the package should either disallow keys matching `__proto__`, `constructor.prototype`, or similar prototype-altering properties, or use a safe merge utility (e.g., `Object.create(null)` for the target) that prevents prototype pollution.

(async () => { const lib = await import('@abip/sp-common'); var victim = {}; console.log("Before Attack: ", JSON.stringify(victim.__proto__)); try { lib.mergeDeep(emptyObj, JSON.parse('{"__proto__":{"test":123}}')); } catch (e) { } console.log("After Attack: ", JSON.stringify(victim.__proto__)); delete Object.prototype.polluted; })();