CVE-2020-8203: Lodash Prototype Pollution Vulnerability

CVE-2020-8203 Overview

CVE-2020-8203 is a prototype pollution vulnerability in Lodash, a widely used JavaScript utility library. The flaw exists in the _.zipObjectDeep function in versions prior to 4.17.20. An attacker who controls property paths passed to this function can modify the Object.prototype, injecting or overwriting properties inherited by every object in the running Node.js process. The vulnerability impacts integrity and availability and affects numerous Oracle enterprise products that bundle the vulnerable Lodash version, including Oracle Banking, Communications, PeopleSoft, JD Edwards, and Primavera Gateway product families.

Critical Impact
Successful prototype pollution can lead to denial of service, application logic tampering, authentication bypass, or remote code execution depending on how the host application consumes polluted properties.

Affected Products

Lodash versions before 4.17.20 (Node.js)
Oracle Banking product family (Corporate Lending, Credit Facilities, Extensibility Workbench, Liquidity Management, Supply Chain Finance, Trade Finance, Virtual Account Management) versions 14.2.0, 14.3.0, 14.5.0
Oracle Communications products (Billing and Revenue Management, Cloud Native Core Policy, Session Border Controller, Session Router, Subscriber-Aware Load Balancer, Enterprise Communications Broker), Oracle Blockchain Platform, JD Edwards EnterpriseOne Tools, PeopleSoft Enterprise PeopleTools 8.58/8.59, and Primavera Gateway

Discovery Timeline

2020-07-15 - CVE-2020-8203 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-8203

Vulnerability Analysis

The vulnerability is a prototype pollution flaw classified under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes) and [CWE-770] (Allocation of Resources Without Limits or Throttling). Lodash's _.zipObjectDeep(props, values) recursively assigns values to nested property paths. When the function processes attacker-controlled path strings containing __proto__ or constructor.prototype segments, it walks into the base object prototype instead of a target object. Subsequent assignments mutate Object.prototype, leaking the change to every object created in the JavaScript runtime. The exploit is network-reachable when applications pass untrusted JSON or query parameters into zipObjectDeep.

Root Cause

The zipObjectDeep implementation in Lodash relies on internal helpers such as baseSet and castPath to traverse nested paths. Before version 4.17.20, these helpers did not blacklist dangerous property names like __proto__, constructor, or prototype. Path segments resolving to these keys allowed assignment into the shared prototype chain rather than a fresh nested object structure.

Attack Vector

An attacker submits crafted input such as a path of __proto__.polluted paired with a value of true to any endpoint or function that forwards user data into _.zipObjectDeep. After pollution, all subsequent objects inherit the injected property. Depending on application logic, this can bypass authorization checks, alter template rendering, trigger denial of service through unexpected property reads, or chain into gadget-based remote code execution in server-side Node.js applications.

No verified public exploit code is referenced in the advisory. See the GitHub Issue Discussion and the HackerOne Vulnerability Report for technical proof-of-concept details.

Detection Methods for CVE-2020-8203

Indicators of Compromise

HTTP request bodies, query strings, or JSON payloads containing __proto__, constructor.prototype, or prototype. substrings in property names or path arrays
Unexpected global property values appearing on freshly created objects in application logs or error traces
Application errors referencing tampered prototype methods such as toString or hasOwnProperty

Detection Strategies

Inventory all Node.js applications and bundled artifacts for Lodash versions below 4.17.20 using software composition analysis tooling
Inspect application code for direct or transitive calls to _.zipObjectDeep, _.set, _.setWith, and _.merge operating on untrusted input
Deploy web application firewall rules that flag request parameters containing __proto__ or constructor[prototype] tokens

Monitoring Recommendations

Alert on outbound child process spawns or file writes originating from Node.js services that should not perform such actions
Forward Node.js runtime exceptions to a centralized log platform and review anomalies in object property access patterns
Track dependency manifests (package-lock.json, yarn.lock) in CI pipelines to identify reintroduction of vulnerable Lodash versions

How to Mitigate CVE-2020-8203

Immediate Actions Required

Upgrade Lodash to version 4.17.20 or later in all direct and transitive dependencies
Apply the relevant Oracle Critical Patch Update for affected Oracle products, including the Oracle April 2021, July 2021, October 2021, January 2022, and April 2022 advisories
Audit application code for usage of _.zipObjectDeep with attacker-controlled paths and refactor where necessary

Patch Information

Lodash 4.17.20 introduces guards against unsafe property names in deep-set helpers, blocking __proto__, constructor, and prototype path segments. Oracle distributes fixed Lodash bundles through its quarterly Critical Patch Updates. Refer to the NetApp Security Advisory for guidance on affected NetApp products.

Workarounds

Validate and sanitize user-supplied JSON keys before passing them to Lodash deep manipulation functions, rejecting any path containing __proto__, constructor, or prototype
Freeze the base prototype at application startup using Object.freeze(Object.prototype) after compatibility testing
Replace _.zipObjectDeep with safer alternatives that operate on null-prototype objects created via Object.create(null)

bash

# Upgrade Lodash to a patched version
npm install lodash@^4.17.20
npm audit fix

# Verify the installed version
npm ls lodash