Questions tagged [prototype-pollution]
Attacks leveraging weaknesses letting attackers modify the prototype of an object. This can happend in prototype based languages like JavaScript.
4
questions
1
vote
0
answers
72
views
Is checking to see if any parameters contain "__proto___" an effective way to mitigate Prototype Pollution vulnerability?
let key = keys[j] === '' ? (currentParams as any).length : keys[j];
if (key === '__proto__') {
throw new Error('Prototype pollution detected.');
}
It at least defeats basic url-encoding,...
- 412
0
votes
2
answers
288
views
Does CSP mitigate against client prototype pollution XSS and DOM XSS?
DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
- 101
2
votes
3
answers
2k
views
Is prototype pollution only exploitable on the back end?
I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
- 423
6
votes
1
answer
3k
views
How to deal with prototype pollution attack vulnerability in lodash?
lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5
See https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Now lodash is the most ...
- 163