Skip to main content

Prototype Pollution

Description​

An application object, method or module can be overwritten with malicious logic due to the lack of validations and the nature of the JavaScript language.

Impact​

  • Overwrite or pollute the behavior of existing methods in the application.
  • Lead to dangerous vulnerabilities suchs as XSS, SQLi, RCE, among others.

Recommendation​

  • Implement integrity validations on the vulnerable objects.
  • Restrict and Discourage the use harmful properties such as proto in the system objects.

Threat​

Authenticated attacker from the Internet.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the src.

Base​

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal​

  • Exploit code maturity: P
  • Remediation level: U
  • Report confidence: R

Result​

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R
  • Score:
    • Base: 3.1
    • Temporal: 2.8
  • Severity:
    • Base: Low
    • Temporal: Low

Score 4.0​

Default score using CVSS 4.0 . It may change depending on the context of the src.

Base 4.0​

  • Attack vector: N
  • Attack complexity: H
  • Attack Requirements: N
  • Privileges required: L
  • User interaction: N
  • Confidentiality (VC): N
  • Integrity (VI): L
  • Availability (VA): N
  • Confidentiality (SC): N
  • Integrity (SI): N
  • Availability (SA): N

Threat 4.0​

  • Exploit maturity: P

Result 4.0​

  • Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
  • Score:
    • CVSS-BT: 1.3
  • Severity:
    • CVSS-BT: Low

Compliant code​

There are no harmful functionalities on vulnerable objects

function modifyPrototype(moduleName, deleteMethod, newMethod) {
  var newMod = new moduleName;

  //Add new method to the object, without altering the original
  newMod.${newMethod} = function() {
      //Add functionality to object
  };

  return newMod;
}

Non compliant code​

There are functionalities that can be overwritten due to insecure coding practices

function modifyPrototype(moduleName, deleteMethod, newMethod) {
  // modifying the prototype of a module from within another function
  var newMod = require(moduleName);
  delete newMod[deleteMethod];
  newMod.${newMethod} = function() {
      // function body that modifies the original method
  };

  module.exports = newMod;
}

Requirements​

Fixes​

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Last updated on