Questions tagged [prototype-pollution]

Attacks leveraging weaknesses letting attackers modify the prototype of an object. This can happend in prototype based languages like JavaScript.

Filter by
Sorted by
Tagged with
1 vote
0 answers
72 views

Is checking to see if any parameters contain "__proto___" an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
user avatar
  • 412
0 votes
2 answers
288 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
user avatar
  • 101
2 votes
3 answers
2k views

Is prototype pollution only exploitable on the back end?

I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
user avatar
6 votes
1 answer
3k views

How to deal with prototype pollution attack vulnerability in lodash?

lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5 See https://nvd.nist.gov/vuln/detail/CVE-2018-3721 Now lodash is the most ...
user avatar