Improper Input Validation Affecting derby package, versions <2.3.2 >=3.0.0 <3.0.2 >=4.0.0-beta.2 <4.0.0-beta.11
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-DERBY-6619753
- published 18 Apr 2024
- disclosed 17 Apr 2024
- credit deadbeafda
How to fix?
Upgrade derby to version 2.3.2, 3.0.2, 4.0.0-beta.11 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation due to the this.lastSegment variable in the emit function not being sanitized. An attacker can manipulate the this.lastSegment variable to set it to __proto__, leading to prototype pollution.
Notes:
1)If the application author has atypical HTML templates that feed user input into an object key.
- Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.