Improper Input Validation Affecting derby package, versions <2.3.2 >=3.0.0 <3.0.2 >=4.0.0-beta.2 <4.0.0-beta.11


0.0
medium
0
10

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DERBY-6619753
  • published 18 Apr 2024
  • disclosed 17 Apr 2024
  • credit deadbeafda

Introduced: 17 Apr 2024

CVE NOT AVAILABLE CWE-1321 Open this link in a new tab

How to fix?

Upgrade derby to version 2.3.2, 3.0.2, 4.0.0-beta.11 or higher.

Overview

Affected versions of this package are vulnerable to Improper Input Validation due to the this.lastSegment variable in the emit function not being sanitized. An attacker can manipulate the this.lastSegment variable to set it to __proto__, leading to prototype pollution.

Notes:

1)If the application author has atypical HTML templates that feed user input into an object key.

  1. Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.