CVE-2018-16489
Prototype Pollution vulnerability in just-extend (npm)
What is CVE-2018-16489 About?
Versions of `just-extend` before 4.0.0 are vulnerable to prototype pollution. This allows an attacker, by providing specific input, to add or modify properties of the `Object` prototype, affecting all objects in the application. Exploitation relies on applications using `just-extend` with attacker-controlled input.
Affected Software
Technical Details
The just-extend library implements a utility for extending objects, merging properties from one object to another. In versions prior to 4.0.0, the merging logic does not adequately secure against properties named __proto__ or constructor.prototype. An attacker can provide an input object containing a __proto__ property with arbitrary values. When just-extend recursively processes this input, it will inadvertently modify the global Object.prototype, adding or altering properties that will then be inherited by all subsequent objects in the JavaScript runtime environment. This 'prototype pollution' can lead to various issues, such as denial of service, remote code execution, or security feature bypass, depending on how other parts of the application interact with object properties.
What is the Impact of CVE-2018-16489?
Successful exploitation may allow attackers to pollute the global `Object` prototype, potentially leading to denial of service, remote code execution, or altering application logic.
What is the Exploitability of CVE-2018-16489?
Exploitation of this prototype pollution vulnerability typically requires moderate complexity. An attacker must be able to supply malformed input that is subsequently processed by the just-extend function within an application. There are no authentication or privilege requirements specific to the vulnerability itself; rather, an attacker needs sufficient access to influence input to the vulnerable function. This can be a remote attack if the application processes external user input via APIs, web forms, or deserialization. The risk of exploitation is significantly increased in applications that broadly use just-extend without input validation or without defensively copying objects before extending them, especially when handling JSON or other structured data from untrusted sources.
What are the Known Public Exploits?
| PoC Author | Link | Commentary |
|---|---|---|
| No known exploits | ||
What are the Available Fixes for CVE-2018-16489?
Available Upgrade Options
- just-extend
- <4.0.0 → Upgrade to 4.0.0
Struggling with dependency upgrades?
See how Resolved Security's drop-in replacements make it simple.
Book a demoAdditional Resources
What are Similar Vulnerabilities to CVE-2018-16489?
Similar Vulnerabilities: CVE-2020-28475 , CVE-2021-23351 , CVE-2022-25883 , CVE-2022-46175 , CVE-2023-37901
