CVE-2022-21213
The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.11% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1321
- Affected
- moutjs/mout
- Source
- report@snyk.io
References
- https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
- https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-MOUT-2342654Exploit, Third Party Advisory
- https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
- https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-MOUT-2342654Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.