CVE-2020-28477: 
JavaScript vulnerability analysis and mitigation

CVE-2020-28477 affects all versions of the immer package prior to version 8.0.1. The vulnerability was discovered and disclosed on October 18, 2020, and was officially published on January 19, 2021. The affected component is the immer package, which is a library that allows developers to create immutable state by mutating the current one (Snyk Advisory).

The vulnerability is classified as a Prototype Pollution issue with a CVSS v3.1 base score of 7.5 (High). The vulnerability exists in the package's functionality where the application is susceptible to prototype pollution attacks through the applyPatches function. The vulnerability allows attackers to manipulate JavaScript's prototype chain by injecting properties into existing JavaScript language construct prototypes (Snyk Advisory).

When successfully exploited, this vulnerability can lead to Denial of Service (DoS), potential Remote Code Execution (RCE), or Property Injection. In DoS scenarios, the attacker can pollute Object.prototype attributes causing application failures. For Property Injection, attackers can manipulate security-related properties like privileges or tokens. The vulnerability affects multiple environments including application servers, web servers, and web browsers (Snyk Advisory).

The vulnerability has a proof-of-concept exploit available. It can be triggered through the applyPatches function by using specific payload structures that target the prototype chain. The attack vector is network-accessible with low attack complexity, requiring no privileges or user interaction (Snyk Advisory).

The recommended mitigation is to upgrade immer to version 8.0.1 or higher. Additional preventive measures include freezing the prototype using Object.freeze(Object.prototype), implementing JSON input schema validation, avoiding unsafe recursive merge functions, and considering the use of objects without prototypes (Object.create(null)). As a best practice, using Map instead of Object is recommended (Snyk Advisory).