CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
780 vulnerabilities reference this CWE, most recent first.
GHSA-4G77-CVGW-GRVW
Vulnerability from github – Published: 2022-02-05 00:00 – Updated: 2022-02-11 16:15This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "putil-merge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23470"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-07T17:15:36Z",
"nvd_published_at": "2022-02-04T20:15:00Z",
"severity": "HIGH"
},
"details": "This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077",
"id": "GHSA-4g77-cvgw-grvw",
"modified": "2022-02-11T16:15:46Z",
"published": "2022-02-05T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23470"
},
{
"type": "WEB",
"url": "https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5"
},
{
"type": "WEB",
"url": "https://github.com/panates/putil-merge"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in putil-merge"
}
GHSA-4G88-FPPR-53PP
Vulnerability from github – Published: 2019-08-27 17:43 – Updated: 2021-08-17 22:17Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
If you are using set-value 3.x, upgrade to version 3.0.1 or later.
If you are using set-value 2.x, upgrade to version 2.0.1 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-value"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "set-value"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0"
]
}
],
"aliases": [
"CVE-2019-10747"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2019-08-27T17:24:50Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.\n\n\n\n\n## Recommendation\n\nIf you are using `set-value` 3.x, upgrade to version 3.0.1 or later.\nIf you are using `set-value` 2.x, upgrade to version 2.0.1 or later.",
"id": "GHSA-4g88-fppr-53pp",
"modified": "2021-08-17T22:17:11Z",
"published": "2019-08-27T17:43:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10747"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SETVALUE-450213"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1012"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in set-value"
}
GHSA-4GXF-G5GF-22H4
Vulnerability from github – Published: 2023-06-10 06:30 – Updated: 2023-06-12 18:34Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dottie"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26132"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-12T18:34:39Z",
"nvd_published_at": "2023-06-10T05:15:08Z",
"severity": "HIGH"
},
"details": "Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the `set()` function and the current variable in the `/dottie.js` file.",
"id": "GHSA-4gxf-g5gf-22h4",
"modified": "2023-06-12T18:34:39Z",
"published": "2023-06-10T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"
},
{
"type": "WEB",
"url": "https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68"
},
{
"type": "PACKAGE",
"url": "https://github.com/mickhansen/dottie.js"
},
{
"type": "WEB",
"url": "https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js#L107"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "dottie vulnerable to Prototype Pollution"
}
GHSA-4H4X-4M75-47J4
Vulnerability from github – Published: 2025-03-28 21:30 – Updated: 2025-03-31 15:56janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "depath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "cool-path"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38985"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-31T15:56:47Z",
"nvd_published_at": "2025-03-28T21:15:16Z",
"severity": "HIGH"
},
"details": "janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-4h4x-4m75-47j4",
"modified": "2025-03-31T15:56:47Z",
"published": "2025-03-28T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38985"
},
{
"type": "WEB",
"url": "https://github.com/janryWang/depath/issues/11"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d"
},
{
"type": "PACKAGE",
"url": "https://github.com/janryWang/depath"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "depath and cool-path vulnerable to Prototype Pollution via `set()` Method"
}
GHSA-4HQ8-JGR8-MW9J
Vulnerability from github – Published: 2022-07-18 00:00 – Updated: 2022-08-05 15:54This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "grunt-util-property"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7641"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-21T21:37:35Z",
"nvd_published_at": "2022-07-17T09:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.",
"id": "GHSA-4hq8-jgr8-mw9j",
"modified": "2022-08-05T15:54:03Z",
"published": "2022-07-18T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7641"
},
{
"type": "PACKAGE",
"url": "https://github.com/mikaelkaron/grunt-util-property"
},
{
"type": "WEB",
"url": "https://github.com/mikaelkaron/grunt-util-property/blob/master/main.js%23L41"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-GRUNTUTILPROPERTY-565088"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload"
}
GHSA-4HWX-XCC5-2HFC
Vulnerability from github – Published: 2025-04-07 16:38 – Updated: 2025-04-07 16:38A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.
Impact
An attacker with high privileges could exploit this vulnerability to: - Modify object prototypes, affecting core JavaScript behavior, - Cause application crashes or unexpected behavior, - Potentially introduce further security vulnerabilities depending on the application's architecture.
Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b
The issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tarteaucitronjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-31475"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-07T16:38:52Z",
"nvd_published_at": "2025-04-07T15:15:44Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in `tarteaucitron.js`, where the `addOrUpdate` function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site\u0027s source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Modify object prototypes, affecting core JavaScript behavior,\n- Cause application crashes or unexpected behavior,\n- Potentially introduce further security vulnerabilities depending on the application\u0027s architecture.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b\nThe issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.",
"id": "GHSA-4hwx-xcc5-2hfc",
"modified": "2025-04-07T16:38:52Z",
"published": "2025-04-07T16:38:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31475"
},
{
"type": "WEB",
"url": "https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b"
},
{
"type": "PACKAGE",
"url": "https://github.com/AmauriC/tarteaucitron.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "tarteaucitron.js allows prototype pollution via custom text injection"
}
GHSA-4JJ4-M52P-8RX3
Vulnerability from github – Published: 2021-04-13 15:24 – Updated: 2021-04-07 22:31Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-object-value"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28281"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-07T22:31:58Z",
"nvd_published_at": "2020-12-29T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u0027set-object-value\u0027 versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-4jj4-m52p-8rx3",
"modified": "2021-04-07T22:31:58Z",
"published": "2021-04-13T15:24:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28281"
},
{
"type": "WEB",
"url": "https://github.com/react-atomic/react-atomic-organism/blob/e5645a2f9e632ffdebc83d720498831e09754c22/packages/lib/set-object-value/src/index.js#L16"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28281"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in set-object-value"
}
GHSA-4JQC-8M5R-9RPR
Vulnerability from github – Published: 2021-09-13 20:09 – Updated: 2023-11-03 20:24This affects the package set-value. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-value"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "set-value-nuget"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "set-value"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "set-value"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23440"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-843"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-13T19:33:18Z",
"nvd_published_at": "2021-09-12T13:15:00Z",
"severity": "HIGH"
},
"details": "This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.",
"id": "GHSA-4jqc-8m5r-9rpr",
"modified": "2023-11-03T20:24:57Z",
"published": "2021-09-13T20:09:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23440"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/pull/33"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"
},
{
"type": "PACKAGE",
"url": "https://github.com/jonschlinkert/set-value"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541"
},
{
"type": "WEB",
"url": "https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in set-value"
}
GHSA-4JRM-C32X-W4JF
Vulnerability from github – Published: 2023-01-10 21:50 – Updated: 2024-11-26 18:58Impact
- An attacker can inject attributes that are used in other components
- An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.
Patches
The problem is patched in convict@6.2.4. Users should upgrade to convict@6.2.4.
Workarounds
No way for users to fix or remediate the vulnerability without upgrading
References
https://github.com/mozilla/node-convict/issues/410
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "convict"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-0163"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-10T21:50:00Z",
"nvd_published_at": "2024-11-26T12:15:17Z",
"severity": "HIGH"
},
"details": "### Impact\n\n* An attacker can inject attributes that are used in other components\n* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.\n\nThe main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it\u0027s unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.\n\n### Patches\nThe problem is patched in `convict@6.2.4`. Users should upgrade to `convict@6.2.4`.\n\n### Workarounds\nNo way for users to fix or remediate the vulnerability without upgrading\n\n### References\nhttps://github.com/mozilla/node-convict/issues/410\n",
"id": "GHSA-4jrm-c32x-w4jf",
"modified": "2024-11-26T18:58:52Z",
"published": "2023-01-10T21:50:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0163"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/node-convict/issues/410"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/node-convict/commit/fb602fbe1e9f14f2e88ecb8179d0f76466d21ecb"
},
{
"type": "PACKAGE",
"url": "https://github.com/mozilla/node-convict"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "convict vulnerable to Prototype Pollution"
}
GHSA-4M8H-H59M-M34J
Vulnerability from github – Published: 2022-02-01 00:50 – Updated: 2022-02-07 21:21The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in CVE-2020-7736
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bmoor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23558"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-31T20:51:31Z",
"nvd_published_at": "2022-01-28T22:15:00Z",
"severity": "HIGH"
},
"details": "The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)",
"id": "GHSA-4m8h-h59m-m34j",
"modified": "2022-02-07T21:21:00Z",
"published": "2022-02-01T00:50:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23558"
},
{
"type": "WEB",
"url": "https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b"
},
{
"type": "WEB",
"url": "https://github.com/b-heilman/bmoor"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664"
},
{
"type": "WEB",
"url": "https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-BMOOR-2342622"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in bmoor"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.