Security Fix for Prototype Pollution - huntr.dev

[huntr-helper]

https://huntr.dev/users/alromh87 has fixed the Prototype Pollution vulnerability 🔨. alromh87 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/merge/1/README.md

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-merge

⚙️ Description *

js.merge package is vulnerable to prototype pollution issue

💻 Technical Description *

Fixed by adding missing magical attributes, to filter.
- if (key === '__proto__'){
+ if (key === '__proto__' || key === 'constructor' || key === 'prototype'){

🐛 Proof of Concept (PoC) *

1. Install the package, run the below code:

var mergelib = require('merge');
var obj = mergelib({}, JSON.parse('{ "testProperty": "hi", "prototype" : { "status" : "pwned!" } }'));
console.log(obj.prototype.status);

Outputs: pwned.

🔥 Proof of Fix (PoF) *

After fix prototype.status is undefined

👍 User Acceptance Testing (UAT)

After fix functionality is unafected

[JamieSlome]

@yeikos @zeke - let me know if you have any thoughts or questions regarding the fix.

Cheers! 🍰