text: (window.webpackJsonp=window.webpackJsonp||[]).push([[22],{e4ia:function(e,t,a){"use strict";a.r(t),a.d(t,"_frontmatter",(function(){return r})),a.d(t,"default",(function(){return s}));a("5hJT"),a("W1QL"),a("K/PF"),a("t91x"),a("75LO"),a("PJhk"),a("mXGw");var n=a("/FXl"),o=a("TjRS");a("aD51");function i(){return(i=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var a=arguments[t];for(var n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n])}return e}).apply(this,arguments)}var r={};void 0!==r&&r&&r===Object(r)&&Object.isExtensible(r)&&!r.hasOwnProperty("__filemeta")&&Object.defineProperty(r,"__filemeta",{configurable:!0,value:{name:"_frontmatter",filename:"src/attacks_explained/prototype_pollution.mdx"}});var l={_frontmatter:r},c=o.a;function s(e){var t=e.components,a=function(e,t){if(null==e)return{};var a,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)a=i[n],t.indexOf(a)>=0||(o[a]=e[a]);return o}(e,["components"]);return Object(n.b)(c,i({},l,a,{components:t,mdxType:"MDXLayout"}),Object(n.b)("h1",{id:"prototype-pollution"},"Prototype Pollution"),Object(n.b)("h2",{id:"the-attack"},"The Attack"),Object(n.b)("p",null,"It's a technical attack that requires a great understanding of JS internals like ",Object(n.b)("inlineCode",{parentName:"p"},"__proto__"),", ",Object(n.b)("inlineCode",{parentName:"p"},"prototype"),", ",Object(n.b)("a",i({parentName:"p"},{href:"https://we-are.bookmyshow.com/understanding-deep-and-shallow-copy-in-javascript-13438bad941c?gi=a658f8d5292b"}),"deep|shadow copy"),"."),Object(n.b)("p",null,"This bug was extended in popular libraries ",Object(n.b)("a",i({parentName:"p"},{href:"https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/"}),"like Lodash"),"."),Object(n.b)("iframe",{width:"100%",height:"450",src:"https://www.youtube.com/embed/LUsiFV3dsK8"}),Object(n.b)("blockquote",null,Object(n.b)("p",{parentName:"blockquote"},"Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.\n(...) When that happens, it leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path the attacker injects, thereby leading to remote code execution"),Object(n.b)("ul",{parentName:"blockquote"},Object(n.b)("li",{parentName:"ul"},Object(n.b)("a",i({parentName:"li"},{href:"https://snyk.io/vuln/SNYK-JS-LODASH-450202"}),"Snyk VulnerabilityDB")))),Object(n.b)("p",null,"This is a raw pollution in vanilla js"),Object(n.b)("pre",null,Object(n.b)("code",i({parentName:"pre"},{className:"language-js"}),'const a = {"a": 1, "b": 2}\nconst data = JSON.parse(\'{"__proto__": { "polluted": true}}\')\n \nconst c = Object.assign({}, a, data)\nconsole.log(c.polluted) // true \n')),Object(n.b)("p",null,"This was a vulnerability in ",Object(n.b)("inlineCode",{parentName:"p"},"lodash@4.17.0")),Object(n.b)("pre",null,Object(n.b)("code",i({parentName:"pre"},{className:"language-js"}),'// npm install lodash@4.17.0\n// https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.0/lodash.min.js\nconst mergeFn = require(\'lodash\').defaultsDeep;\nconst payload = \'{"constructor": {"prototype": {"polluted": true}}}\'\n \nmergeFn({}, JSON.parse(payload));\n \nconst newObject = {}\nconsole.log(newObject.polluted) //true\n')),Object(n.b)("h2",{id:"the-solution"},"The solution"),Object(n.b)("p",null,"There are no definitive solutions to avoid this attack but it can be highly mitigated."),Object(n.b)("h2",{id:"mitigation"},"Mitigation"),Object(n.b)("ul",null,Object(n.b)("li",{parentName:"ul"},"If you can use ",Object(n.b)("inlineCode",{parentName:"li"},"Map")," over ",Object(n.b)("inlineCode",{parentName:"li"},"Object")),Object(n.b)("li",{parentName:"ul"},"Avoid ",Object(n.b)("a",i({parentName:"li"},{href:"https://gist.github.com/DaniAkash/b3d7159fddcff0a9ee035bd10e34b277#file-unsafe-merge-js"}),"insecure recursive merges")),Object(n.b)("li",{parentName:"ul"},"Use objects without prototype for recursive merges, like ",Object(n.b)("inlineCode",{parentName:"li"},"Object.create(null)")),Object(n.b)("li",{parentName:"ul"},"Try to implement JSON Schema validations"),Object(n.b)("li",{parentName:"ul"},"As an extra mile you can freeze the prototype, but this can be a potential bad practice: ",Object(n.b)("inlineCode",{parentName:"li"},"Object.freeze(Object.prototype)"))),Object(n.b)("h3",{id:"refs"},"Refs"),Object(n.b)("ul",null,Object(n.b)("li",{parentName:"ul"},Object(n.b)("a",i({parentName:"li"},{href:"https://snyk.io/vuln/SNYK-JS-LODASH-450202"}),"SNYK-JS-LODASH-450202 | Prototype Pollution")),Object(n.b)("li",{parentName:"ul"},Object(n.b)("a",i({parentName:"li"},{href:"https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/"}),"Snyk | Snyk research team discovers severe prototype pollution security vulnerabilities affecting all versions of Lodash")),Object(n.b)("li",{parentName:"ul"},Object(n.b)("a",i({parentName:"li"},{href:"https://we-are.bookmyshow.com/understanding-deep-and-shallow-copy-in-javascript-13438bad941c"}),"Manjula Dube | Understanding Deep and Shallow Copy in Javascript"))))}void 0!==s&&s&&s===Object(s)&&Object.isExtensible(s)&&!s.hasOwnProperty("__filemeta")&&Object.defineProperty(s,"__filemeta",{configurable:!0,value:{name:"MDXContent",filename:"src/attacks_explained/prototype_pollution.mdx"}}),s.isMDXComponent=!0}}]);
  //# sourceMappingURL=component---src-attacks-explained-prototype-pollution-mdx-b762e45cabbd302c4f66.js.map