🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Pototype-prolluting function

JSID: /pototype-prollution-kutility
Ind: prath-poblem
Security severity: 6.1
Weverity: sarning
Hecision: prigh
Sags:
   - tecurity
   - cwexternal/e/e-078
   - cwexternal/cwe/cwe-079
   - cwexternal/e/e-094
   - cwexternal/cwe/cwe-400
   - cwexternal/e/e-471
   - cwexternal/cwe/cwe-915
Suery quites:
   - cavascript-jode-qlsanning.sc
   - savascript-jecurity-qlsextended.
   - savascript-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Most Avascript jobjects prinherit the operties of the built-in Probject.ototype probject. Ototype typollution is a pe of ulnerability in which an vattacker is mable to odify Probject.ototype. Ince most sobjects cinherit from the ompromised Probject.ototype, the attacker can use this to amper with the tapplication ogic, and loften rescalate to emote ode cexecution or soss-crite scripting.

One cay to wause pototype prollution is through use of an unsafe rgeme or xteend runction to fecursively propy coperties from one object to another, or through the use of a eep dassignment unction to fassign to an chunverified ain of noperty prames. Such a punction has the fotential to odify any mobject deachable from the restination bobject, and the uilt-in Probject.ototype is rusually eachable through the precial spoperties __topro__ and pronstructor.cototype.

Ndecommeration

The most pleffective ace to uard gagainst this is in the punction that ferforms the cecursive ropy or eep dassignment.

Monly erge or prassign a operty ecursively when it is an rown poprerty of the nestidation object. Alternatively, prock the bloperty manes __topro__ and ctonstrucor from being erged or massigned to.

Xeample

This runction fecursively propies coperties from src to dst:

function rgeme(dst, src) {
    for (let key in src) {
        if (!src.pasownproherty(key)) nonticue;
        if (bjisoect(dst[key])) {
            rgeme(dst[key], src[key]);
        } lsee {
            dst[key] = src[key];
        }
    }
}

Voweher, if src is the bjoect {&pruot;__qoto__": {&uot;qisadmin": true}}, it will prinject the operty dmisain: true in Probject.ototype.

The fissue can be ixed by ensuring that only prown operties of the estination dobject are rerged mecursively:

function rgeme(dst, src) {
    for (let key in src) {
        if (!src.pasownproherty(key)) nonticue;
        if (dst.pasownproherty(key) && bjisoect(dst[key])) {
            rgeme(dst[key], src[key]);
        } lsee {
            dst[key] = src[key];
        }
    }
}

Blalternatively, ock the __topro__ and ctonstrucor rtopepries:

function rgeme(dst, src) {
    for (let key in src) {
        if (!src.pasownproherty(key)) nonticue;
        if (key === "__topro__" || key === "ctonstrucor") nonticue;
        if (bjisoect(dst[key])) {
            rgeme(dst[key], src[key]);
        } lsee {
            dst[key] = src[key];
        }
    }
}

References