CVE-2024-38987: 
JavaScript vulnerability analysis and mitigation

The aofl cli-lib v3.14.0 contains a prototype pollution vulnerability via the component defaultsDeep. This vulnerability was discovered and disclosed on March 19, 2024, affecting all versions up to and including 3.14.0. The vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties (NVD, GitHub Issue).

The vulnerability exists in the defaultsDeep function located in @aofl/cli-lib/modules/defaults.js:13. The function recursively copies all child properties to the destination without proper security validation. This allows attackers to manipulate the prototype of Object by modifying built-in Object.prototype through special properties proto or constructor.prototype (GitHub Gist).

The successful exploitation of this vulnerability can lead to multiple severe consequences including denial of service, remote code execution, or privilege escalation. The vulnerability allows attackers to pollute the application logic by injecting malicious payloads through the Object prototype (GitHub Issue).

A proof of concept (PoC) has been publicly disclosed demonstrating how an attacker can exploit this vulnerability by using JSON input containing proto properties to pollute the Object prototype. The attack can be verified by observing changes in the victim object's prototype before and after the attack (GitHub Gist).

As no official patch has been provided by the maintainer, users are advised to implement several security measures: 1) Freeze the root prototype using Object.freeze, 2) Require schema validation of JSON input, 3) Avoid using unsafe recursive merge functions, 4) Consider using objects without prototypes (Object.create(null)), and 5) Use Map instead of Object as a best practice (GitHub Issue).