Lodash Vulnerable to Prototype Pollution
CVE-2019-10744

9.1CRITICAL

Key Information:

Vendor

Snyk

Status
Lodash
Vendor
CVE Published:
26 July 2019

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-10744?

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Affected Version(s)

lodash All versions prior to 4.17.12

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

aurora-demo-lockfile
Created by mlbrilliance

cortex9-lodash-defaultsdeep-prototype-pollution-model
Created by federiconbaez

References

https://access.redhat.com/errata/RHSA-2019:3024
vendor-advisoryx_refsource_REDHAT
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC
https://snyk.io/vuln/SNYK-JS-LODASH-450202
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.