stackexchange uses an unpached version of jQuery < 3.4.0 which exposes it to prototype pollution in stackexchange/dnscontrol
Reported on
Jul 12th 2022
Description
By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones.
This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf)
Impact
- Integrity: An attacker can inject attributes that are used in other components.
- Availability: An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
Occurrences
default.html L10
Proof of Concept
Open your browser console and paste the following code:
$.extend(true, {}, JSON.parse('{ "__proto__": { "polluted": true } }'))
console.log({}.polluted)
// returns true
Mitigation
Patch can be found in the following link:
https://github.com/DanielRuf/snyk-js-jquery-174006
Proof of Fix
After fixing your code, the same command should return undefined:
$.extend(true, {}, JSON.parse('{ "__proto__": { "polluted": true } }'))
console.log({}.polluted)
// returns undefined
SECURITY.md
10 months ago
Hi Timothee, it looks like you tried to edit the report on 12th July @ 1 PM UTC. This process failed, and so I have re-run this for you just now :)