CVE-2018-3728: High severity @hapi/hoek vulnerability

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

— MITRE

Versions of hoek prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the proto property.

This can be demonstrated like so:

javascript var Hoek = require('hoek'); var maliciouspayload = '{"proto":{"oops":"It works !"}}';

var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(maliciouspayload)); console.log("After : " + a.oops);

This type of attack can be used to overwrite existing properties causing a potential denial of service.

Recommendation

Update to version 4.2.1, 5.0.3 or later.

— GitHub