Closed huntr-helper closed 3 years ago
Hi, thanks for the pull request.
The repo has already been updated with a fix for this issue (see test case which caters for all properties potentially available on the object prototype rather than an explicitly named list.
You can make use of the fixed version by updating to version 2.2.0, available via npm
https://huntr.dev/users/d3m0n-r00t has fixed the Prototype Pollution vulnerability π¨. Think you could fix a vulnerability like this?
Get involved at https://huntr.dev/
Q | A Version Affected | ALL Bug Fix | YES Original Pull Request | https://github.com/418sec/properties/pull/1 Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/properties-reader/1/README.md
User Comments:
π Metadata *
Fixed
Prototype Pollution
inproperties
Bounty URL: https://www.huntr.dev/bounties/1-npm-properties-reader
βοΈ Description *
properties-reader
is vulnerable toPrototype Pollution
. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as_proto_
,constructor
andprototype
. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.π» Technical Description *
The bug is fixed by validating the input
src
to check for prototypes. It is implemented by a simple validation to check for prototype keywords(__proto__, constructor and prototype)
, where if it exists, the function returns the object without modifying it, thus fixing the Prototype Pollution Vulnerability.π Proof of Concept (PoC) *
π₯ Proof of Fix (PoF) *
After the fix is applied, it returns
undefined
since the polluted referred in the PoC is no more accessible(which is intended). Hence fixing the issue.π User Acceptance Testing (UAT)
All ok.