Jonchurch

The `escapeLogField()` function fails to escape the double quote character used to delimit quoted fields in the Apache combined log format. An unauthenticated remote attacker can exploit this by injecting a double quote into values written to quoted fields, such as the `User-Agent` or `Referer` headers. This allows the attacker to close a field prematurely, causing log consumers that parse by field position to interpret attacker-supplied text as subsequent fields. In built-in formats, this results in recorded values differing from the actual sent values, and in custom formats, it can be used to forge server-controlled values like the response status. Record separation remains intact as no newlines are injected.

An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records.

Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior.

The software contains a flaw related to template compilation. Specifically, insufficient validation of key names within the `options.imports` object used by the ` .template` function can allow an attacker to inject default-parameter expressions, leading to arbitrary code execution. The issue arises because validation applied to the `option` variable is not extended to the `options.imports` key names. Furthermore, the use of `assignInWith` can introduce vulnerabilities if `Object.prototype` has been compromised, potentially copying polluted keys into the imports object and ultimately executing malicious code.