CVE-2022-24802
📋 TL;DR
deepmerge-ts is vulnerable to Prototype Pollution, allowing attackers to modify object prototypes and potentially execute arbitrary code or cause denial of service. This affects any application using vulnerable versions of the deepmerge-ts TypeScript library for object merging operations.
💻 Affected Systems
- deepmerge-ts
📦 What is this software?
Deepmerge Ts by Deepmerge Ts Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes, data corruption, or privilege escalation within the affected application.
If Mitigated
Limited impact if input validation and sandboxing prevent malicious payloads from reaching the vulnerable function.
🎯 Exploit Status
Exploitation requires attacker-controlled input to the deepmerge function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2
Vendor Advisory: https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq
Restart Required: No
Instructions:
1. Update deepmerge-ts to version 4.0.2 or later using npm: npm update deepmerge-ts. 2. Verify no breaking changes in your application. 3. Test thoroughly after update.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to prevent malicious objects from reaching the deepmerge function.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all objects passed to deepmerge functions.
- Isolate the application using network segmentation and restrict access to minimize attack surface.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for deepmerge-ts version. If version is below 4.0.2, it is vulnerable.Check Version:
npm list deepmerge-tsVerify Fix Applied:
After updating, verify deepmerge-ts version is 4.0.2 or higher using npm list deepmerge-ts.📡 Detection & Monitoring
Log Indicators:
- Unusual application crashes, unexpected object property modifications, or prototype pollution attempts in logs.
Network Indicators:
- Unusual outbound connections from the application post-exploitation.
SIEM Query:
Search for application logs containing deepmerge function errors or unexpected object modifications.🔗 References
- https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72
- https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b
- https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq
- https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72
- https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b
- https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq
