CVE-2024-38986
📋 TL;DR
CVE-2024-38986 is a prototype pollution vulnerability in the 75lb deep-merge library version 1.1.1 that allows attackers to modify object prototypes, potentially leading to arbitrary code execution or denial of service. This affects any application using the vulnerable deep-merge library to merge objects, particularly when processing untrusted user input. The high CVSS score of 9.8 indicates critical severity with network-accessible exploitation.
💻 Affected Systems
- 75lb deep-merge
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing application crashes or instability, potentially leading to data corruption.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application errors.
🎯 Exploit Status
The vulnerability is in a widely used library with public proof-of-concept available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2 or later
Vendor Advisory: https://github.com/75lb/deep-merge
Restart Required: Yes
Instructions:
1. Update deep-merge to version 1.1.2 or later using npm update deep-merge. 2. Restart all affected applications. 3. Test functionality to ensure compatibility.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to prevent malicious objects from being passed to merge functions.
Use alternative merge library
allReplace deep-merge with a secure alternative like lodash.merge or implement custom safe merge functions.
npm uninstall deep-merge
npm install lodash.merge
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all objects passed to merge functions
- Deploy web application firewall (WAF) rules to detect and block prototype pollution attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for deep-merge version 1.1.1. Run: npm list deep-mergeCheck Version:
npm list deep-merge | grep deep-mergeVerify Fix Applied:
Verify deep-merge version is 1.1.2 or later. Run: npm list deep-merge | grep deep-merge📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Memory exhaustion errors
Network Indicators:
- HTTP requests with specially crafted JSON objects
- Unusual merge operation patterns
SIEM Query:
source="application.logs" AND ("deep-merge" OR "prototype pollution" OR "merge error")