Skip to main content

Prototype Pollution

Description

An application object, method or module can be overwritten with malicious logic due to the lack of validations and the nature of the JavaScript language.

Impact

  • Overwrite or pollute the behavior of existing methods in the application.
  • Lead to dangerous vulnerabilities suchs as XSS, SQLi, RCE, among others.

Recommendation

  • Implement integrity validations on the vulnerable objects.
  • Restrict and Discourage the use harmful properties such as proto in the system objects.

Threat

Authenticated attacker from the Internet.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: U
  • Report confidence: R

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R
  • Score:
    • Base: 3.1
    • Temporal: 2.8
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

There are no harmful functionalities on vulnerable objects

function modifyPrototype(moduleName, deleteMethod, newMethod) {
var newMod = new moduleName;

//Add new method to the object, without altering the original
newMod.${newMethod} = function() {
//Add functionality to object
};

return newMod;
}

Non compliant code

There are functionalities that can be overwritten due to insecure coding practices

function modifyPrototype(moduleName, deleteMethod, newMethod) {
// modifying the prototype of a module from within another function
var newMod = require(moduleName);
delete newMod[deleteMethod];
newMod.${newMethod} = function() {
// function body that modifies the original method
};

module.exports = newMod;
}

Requirements