prototype pollution vulnearability due to hoek dependency

Observed following security vulnerability in the grpc node package (even on latest version 1.10.0)

The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__ property. This can be demonstrated like so: javascript var Hoek = require('hoek'); var malicious_payload = '{"__proto__":{"oops":"It works !"}}'; var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops);

This type of attack can be used to overwrite existing properties causing a potential denial of service. This can be fixed by updating the dependency version to hoek@4.2.1

[nicolasnoble]

1.11.1 has been published with the newest version of node-pre-gyp, and we’re upmerging this to master, yes.

[murgatroid99]

That is actually a transitive dependency through node-pre-gyp, which will be updated in the next patch release. Until then, I don’t think there is any API surface for a malicious user to trigger this through gRPC.