CVE-2022-31106
📋 TL;DR
CVE-2022-31106 is a prototype pollution vulnerability in underscore.deep library versions before 0.5.3. Attackers can craft malicious payloads to pollute object prototypes via the deepFromFlat function, potentially leading to remote code execution or denial of service. Any application using underscore.deep with deepFromFlat or deepPick functions is affected.
💻 Affected Systems
- underscore.deep
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial of service, application crashes, or data corruption through prototype pollution.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially causing application errors.
🎯 Exploit Status
Exploitation requires attacker-controlled input reaching vulnerable functions, which is common in web applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.3
Vendor Advisory: https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm
Restart Required: Yes
Instructions:
1. Update package.json to specify underscore.deep version 0.5.3 or higher. 2. Run 'npm update underscore.deep' or 'yarn upgrade underscore.deep'. 3. Restart all affected Node.js applications.
🔧 Temporary Workarounds
Input validation filter
allModify deepFromFlat function to reject inputs containing '__proto__', 'constructor', or 'prototype' keywords
// Add input validation in deepFromFlat function
function deepFromFlat(obj) {
const forbidden = ['__proto__', 'constructor', 'prototype'];
for (const key in obj) {
if (forbidden.some(f => key.includes(f))) {
throw new Error('Invalid input detected');
}
}
// Original function logic here
}
🧯 If You Can't Patch
- Implement strict input validation to reject any user input containing '__proto__', 'constructor', or 'prototype' strings
- Use object-freeze or similar techniques to prevent prototype modification in critical objects
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/underscore.deep/package.json for version number below 0.5.3Check Version:
npm list underscore.deep | grep underscore.deepVerify Fix Applied:
Verify underscore.deep version is 0.5.3 or higher in package.json and test that deepFromFlat rejects malicious payloads📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual prototype modification errors in logs
- Input validation failures for '__proto__' patterns
Network Indicators:
- HTTP requests containing '__proto__', 'constructor', or 'prototype' in parameters
SIEM Query:
source="application.logs" AND ("__proto__" OR "constructor" OR "prototype") AND "underscore.deep"🔗 References
- https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7
- https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm
- https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7
- https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm
