Questions tagged [prototype-pollution]
Attacks leveraging weaknesses letting attackers modify the prototype of an object. This can happend in prototype based languages like JavaScript.
3
questions
0
votes
2answers
104 views
Does CSP mitigate against client prototype pollution XSS and DOM XSS?
DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
2
votes
3answers
1k views
Is prototype pollution only exploitable on the back end?
I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
5
votes
1answer
2k views
How to deal with prototype pollution attack vulnerability in lodash?
lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5
See https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Now lodash is the most ...
