Lodash Prototype Pollution Vulnerability

A prototype pollution vulnerability exists in Lodash versions prior to 4.17.20. The issue arises in the 'zipObjectDeep' function, where an attacker can inject properties into the Object prototype. This manipulation affects all objects, potentially leading to unauthorized data modification or disclosure. Additionally, such exploitation can cause a denial-of-service condition by crashing the server or overwhelming it with requests.

Impact

Exploitation of this vulnerability can result in prototype pollution, allowing attackers to modify the Object prototype. This can lead to the addition or modification of properties on all objects, with potential consequences such as causing a server to crash or become unresponsive. In some cases, this vulnerability could be exploited to achieve remote code execution.

Reproduction

To reproduce this vulnerability, use Lodash version 4.17.15 or earlier. The 'zipObjectDeep' function can be called with an array that includes '__proto__' as a key. This will inject a property into the Object prototype, which can then be accessed through any object.

Remediation

Users should update Lodash to version 4.17.20 or later, where this vulnerability has been addressed.