Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Opis

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Skutki

• Confidentiality, Integrity, Availability

  Read Application Data; Modify Application Data

  This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This creates attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of the object prototype (such as hasOwnProperty, toString, or valueOf).

• Availability

  DoS: Crash, Exit, or Restart

  An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

Zapobieganie

• Implementation

  By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

  Skuteczność: High

• Architecture and Design

  By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

  Skuteczność: High

• Implementation · Input Validation

  When handling untrusted objects, validating using a schema can be used.

  Skuteczność: Limited

• Implementation

  By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

  Skuteczność: High

• Implementation

  Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

  Skuteczność: Moderate

Przykłady podatności

• CVE-2018-3721 Prototype pollution by merging objects.
• CVE-2019-10744 Prototype pollution by setting default values to object attributes recursively.
• CVE-2019-11358 Prototype pollution by merging objects recursively.
• CVE-2020-8203 Prototype pollution by setting object attributes based on dot-separated path.

Słabość nadrzędna

• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
• CWE-913 Improper Control of Dynamically-Managed Code Resources

Może prowadzić do

• CWE-471 Modification of Assumed-Immutable Data (MAID)

Kiedy powstaje

• Architecture and Design
• Implementation — This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.

Dotyczy

JavaScript

Źródła

1. Prototype pollution attack in NodeJS application — Olivier Arteau, 2018
2. What is Prototype Pollution? — Changhui Xu, 2019