Questions tagged [prototype-pollution]

Attacks leveraging weaknesses letting attackers modify the prototype of an object. This can happend in prototype based languages like JavaScript.

Filter by
Sorted by
Tagged with
1 vote
0 answers

Is checking to see if any parameters contain "__proto___" an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
user avatar
  • 412
0 votes
2 answers

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
user avatar
  • 101
2 votes
3 answers

Is prototype pollution only exploitable on the back end?

I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
user avatar
6 votes
1 answer

How to deal with prototype pollution attack vulnerability in lodash?

lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5 See Now lodash is the most ...
user avatar