Questions tagged [prototype-pollution]

Attacks leveraging weaknesses letting attackers modify the prototype of an object. This can happend in prototype based languages like JavaScript.

Filter by
Sorted by
Tagged with
0
votes
2answers
104 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
2
votes
3answers
1k views

Is prototype pollution only exploitable on the back end?

I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
5
votes
1answer
2k views

How to deal with prototype pollution attack vulnerability in lodash?

lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5 See https://nvd.nist.gov/vuln/detail/CVE-2018-3721 Now lodash is the most ...